Amazon has attributed the September 2025 hijacking of the widely-used npm packages ‘debug’ and ‘chalk’ to a North Korean state-sponsored group. This incident, which affected packages with over 2 billion weekly downloads, involved a maintainer being phished through a lookalike npm domain, leading to the insertion of a wallet-draining script into at least 18 packages.
Initially, reports from security firms did not specify the origin of the attack. However, in research published on July 29, 2026, Amazon Threat Intelligence assessed with medium confidence that the group responsible for the March 2026 compromise of the ‘axios’ package was also behind this earlier incident.
Further investigation revealed that the same group had planted a trojanized file in a lesser-known package called ‘typo-crypto’ in March 2025, a full year before the ‘axios’ compromise. Analysts discovered this while tracing a domain registered in 2025 that surfaced during the ‘axios’ investigation. Although downloads for ‘typo-crypto’ were low, the tactics used aligned with those observed in attacks on more popular packages, suggesting it was a test run.
Amazon’s attribution spans four named packages across three campaigns within twelve months. All three campaigns reportedly began with social engineering of trusted maintainers, followed by the publication of malicious updates. Notably, Amazon did not report any new compromises; the response scope for ‘debug’ and ‘chalk’ remained consistent with the previously published mechanisms, with only the attribution being updated.
The evidence presented by Amazon includes shared tradecraft across the campaigns, such as trojanized packages, post-install hooks, code reuse, and overlapping command-and-control indicators. However, specific details tying each piece of evidence to individual incidents were not disclosed.
Independent attributions have also been made regarding the ‘axios’ compromise. Google linked it to UNC1069, citing the WAVESHAPER.V2 backdoor and an AstrillVPN node previously used by the group. Microsoft attributed the same compromise to Sapphire Sleet, which overlaps with activity tracked by other vendors under various names, including UNC1069, STARDUST CHOLLIMA, BlueNoroff, Alluring Pisces, CageyChameleon, and CryptoCore.
Amazon interprets the pattern of these attacks as financially motivated. At the time of the September 2025 incident, security firm Socket estimated that the compromised wallets had netted approximately $600.
The malicious file identified by Amazon, ‘core.js’, masqueraded as the legitimate ‘core-js’ package within the repository. It activated upon detecting a specific hash input and retrieved an operating-system-specific second stage from a hardcoded command-and-control server, obfuscated using base64 over an XOR cipher.
Amazon’s post references the Open Source Vulnerability (OSV) record without specifying a version. The OSV record ‘MAL-2026-3400’ identifies ‘[email protected]’, credits Amazon Inspector, and was published on May 8, 2026, nearly three months before this attribution.
As of July 30, 2026, ‘[email protected]’ remains available on the npm registry. It declares no install script, so downloading it does not automatically execute any code.
This series of incidents underscores the persistent threat posed by state-sponsored actors targeting open-source ecosystems. Developers and organizations must remain vigilant, implementing robust security measures and regularly auditing dependencies to mitigate the risks associated with supply chain attacks.
