Amazon is pointing the finger at North Korea for a spate of npm package compromises, claiming a single group was responsible for several attacks, including a hit on one of the most popular packages in the ecosystem.
In a blog post shared Wednesday, Amazon’s security team said the North Korean group tracked by Microsoft as Sapphire Sleet was linked to supply chain attacks on the typo-crypto, debug, chalk, and axios packages.
Amazon CISO CJ Moses said: “By compromising a small number of highly popular packages, the group gains potential access to thousands of downstream environments simultaneously. For a financially motivated threat actor, this approach is far more efficient than targeting organizations one at a time.”
Npm packages, open source JavaScript code stored on the GitHub-owned npm registry, have been hit by a series of notable attacks between 2025 and 2026, including on HTTP client axios, which sees 100 million+ downloads per week and has more than 170,000 downstream packages.
Shared tactics
Moses said that while the axios attack in March 2026 had already been publicly attributed to the group, Amazon had “medium confidence” it was also responsible for other attacks after identifying shared tactics and command-and-control indicators.
Tactics included using trojanised npm packages, post-install hooks scripts, and code reuse, many identified in the March 2025 breach of the smaller typo-crypto package that Moses said may have served as a testing ground.
He said: “Although the observed download volume was low, the tradecraft aligns with what we later observed in attacks on more popular packages.”
That campaign was linked to the IP address 216.74.123.126 and a trojanised core.js file, which can be used as IOCs.
Amazon’s claim comes about a month after Microsoft also attributed a similar compromise of the Mastra npm packages to Sapphire Sleet.
Supply chain attacks
The potential involvement of a state-backed actor may explain the sophistication of the widespread attacks; Wiz found malicious code from the debug and chalk incidents likely reached 10% of cloud environments.
The goal of the attacks is also unsurprising, with CrowdStrike’s 2026 threat report stating: “Several DPRK-nexus adversaries regularly use supply chain attacks in currency generation operations and target software developers to enable subsequent campaigns.”
In Amazon’s blog post about its research, it said security teams should be increasingly wary of similar attacks in the future, with threat actors frequently behaving “like real maintainers” to gain access to popular software.
Researchers should look for malicious behaviour split across packages, it said, citing one technique using one package to store an encrypted blob disguised as a configuration, another to host decryption logic, and a third to fetch and execute the payload.
The link has been copied!
