SECURITYJul 30 · 06:05 UTCTHE HACKER NEWS[email protected] (The Hacker News)

Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleet

Amazon has linked the September 2025 npm package hijack of debug and chalk to North Korea’s Sapphire Sleet. The incident involved a phished maintainer via a lookalike npm domain and a wallet-draining script in 18 packages with over 2 billion weekly downloads. Earlier reports did not attribute the attack to a nation-state.

Nexus surfaces and summarizes. The full story lives at the source.

Mentioned

AmazonorganizationnpmorganizationdebugtopicchalktopicNorth KoreaplaceSapphire Sleettopic

Spot something wrong with this article?Report a problem →

Forward this

Related Signal

Adjacent reporting

SECURITYJul 29 · 21:09 UTC
A little-known npm package was North Korea’s warm-up act for the axios hack
SECURITYJun 20 · 14:09 UTC
Microsoft links Mastra AI supply chain attack to North Korean hackers
SECURITYJul 4 · 11:17 UTC
North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign
SECURITYJul 3 · 16:07 UTC
North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets
SECURITYJun 1 · 13:30 UTC
NPM packages from RedHat have been compromised