Amazon has linked a series of high-profile npm supply chain compromises spanning 2025 and 2026 to the North Korean threat group Sapphire Sleet, suggesting that attacks initially viewed as isolated incidents may instead represent a coordinated campaign targeting widely trusted open source software.
In a threat intelligence report published on July 29, Amazon assessed with medium confidence that the same actor responsible for the March 2026 compromise of the popular JavaScript package axios was also behind earlier attacks involving the npm packages debug and chalk, as well as a lesser-known package called typo-crypto. The assessment expands the scope of what security researchers now believe to be a sustained operation aimed at infiltrating software supply chains through compromised maintainer accounts.
The September 2025 incident involving debug and chalk drew widespread attention after attackers successfully phished an npm maintainer using a fraudulent npm website designed to harvest credentials. Once access was obtained, malicious updates were published to multiple packages collectively downloaded billions of times each week. Rather than infecting developers' systems directly, the malicious code targeted cryptocurrency users by intercepting browser-based wallet activity and replacing legitimate transaction addresses before users approved transfers.
At the time, security firms including Aikido Security and Wiz documented the compromise and analyzed its technical behavior, but neither publicly attributed the operation to a specific threat actor. Amazon's latest research represents the first detailed effort to connect that incident with a broader campaign linked to North Korea.
According to Amazon, investigators uncovered additional evidence while examining the March 2026 axios compromise. During that investigation, analysts identified a domain registered in 2025 that ultimately led them to a previously overlooked npm package named typo-crypto. Although the package attracted relatively few downloads, Amazon believes it served as an early testing ground for techniques that later appeared in attacks targeting far more widely used libraries.
The company argues that the campaigns share several operational characteristics, including the deployment of trojanized packages, overlapping command-and-control infrastructure, similarities in malicious code, and the use of social engineering to gain access to trusted maintainer accounts before distributing compromised package updates. Based on those shared indicators, Amazon believes the incidents form part of the same long-running operation.
However, the report has also prompted discussion within the security community regarding the strength of the evidence supporting the attribution. While Amazon outlines common tactics and infrastructure across the campaigns, the report does not publicly specify which individual indicators directly connect each incident. As a result, some researchers have noted that although the overall assessment appears plausible, additional technical evidence would help strengthen the case for linking every campaign to the same actor.
The technical methods employed across the attacks also differed substantially.
The malicious code inserted into debug and chalk functioned primarily within web browsers. It intercepted browser APIs associated with cryptocurrency wallets and modified transaction destinations before users authorized transfers. Security researchers observed that the attack did not rely on npm lifecycle scripts or establish persistent malware on infected systems.
By contrast, the March 2026 axios compromise involved a post-install payload that executed during package installation, allowing attackers to deploy additional malicious components. Amazon also identified similarities between that campaign and the earlier typo-crypto package, which contained a disguised file named core.js. The file reportedly activated only after receiving a specific trigger and then retrieved an operating system-specific second-stage payload from a remote command-and-control server.
Amazon identified infrastructure associated with the malicious package, including the domain npmjs.store and the IP address 216.74.123.126. The company also noted that the malware concealed portions of its functionality using Base64 encoding combined with an XOR-based obfuscation routine.
Further examination of the npm registry revealed additional irregularities surrounding typo-crypto. The package appeared to have been published only once, with no earlier legitimate versions preceding the malicious release. Its metadata closely resembled that of the legitimate crypto-js project, including copied descriptions and keywords, while advertising a version number ahead of crypto-js itself. Those characteristics suggest the package was created from the outset to impersonate an established library rather than resulting from the compromise of an existing maintainer account.
Amazon also referenced the Open Source Vulnerabilities database entry MAL-2026-3400 in connection with typo-crypto. Registry records indicate that the package remained publicly available at the time researchers reviewed it. Although it did not declare an install script capable of automatically executing malicious code upon installation, investigators confirmed that the embedded core.js file contained trigger values consistent with Amazon's analysis. Researchers also identified discrepancies involving one published SHA-256 hash, leaving open the possibility of either a documentation error or a hash corresponding to a different sample.
The attribution aligns with assessments previously made by other major cybersecurity vendors regarding the axios compromise. Google attributed that incident to the cluster it tracks as UNC1069, citing malware known as WAVESHAPER.V2 together with infrastructure previously associated with the group. Microsoft separately attributed the operation to Sapphire Sleet, a financially motivated North Korean threat actor also tracked under several alternative names by different security vendors.
Threat intelligence researchers generally consider medium-confidence assessments to indicate that multiple independent indicators support an attribution while acknowledging that additional evidence could alter future conclusions. In this case, Amazon's analysis represents another step toward understanding the relationship between several supply chain attacks, even as researchers continue examining the technical links connecting them.
Open source software ecosystems remain attractive targets because compromising a single trusted package can affect thousands of downstream applications and organizations. Libraries such as debug, chalk, and axios are deeply embedded throughout the JavaScript ecosystem, meaning malicious updates have the potential to propagate rapidly across development environments before they are detected.
The incidents have also renewed attention on software supply chain security. Earlier this month, npm introduced version 12, disabling dependency lifecycle scripts by default to reduce opportunities for post-install malware execution. The registry has also begun scanning newly published packages for malicious code before they become available to users. While these measures help address certain attack techniques, security researchers caution that they do not eliminate the risk posed by compromised maintainer accounts obtained through phishing or other forms of social engineering.
As open source ecosystems continue to expand, security experts expect attackers to increasingly focus on trusted maintainers rather than exploiting software vulnerabilities alone. The latest attribution from Amazon underlines the growing role of identity-based attacks in software supply chain operations and emphasises the continuing need for stronger maintainer protections alongside technical safeguards.
