Amazon Traces September npm Hijack of Debug and Chalk to North Korean Hackers

Key points

• Amazon has attributed the September 2025 takeover of the popular npm packages debug and chalk to North Korean state hackers tracked as Sapphire Sleet.
• The attack began when a package maintainer was phished through a fake npm login page, letting the attackers push malicious updates.
• At least 18 packages were poisoned, with debug and chalk alone pulling more than 2 billion downloads a week between them.
• The injected code was a wallet drainer designed to steal cryptocurrency from developers and users who ran the tainted versions.
• Original reports from security firms Aikido and Wiz did not name a country; Amazon's finding is the first public attribution.

For ten months, one of the largest software supply-chain incidents of 2025 read as a straightforward crypto heist. Amazon now says it was not.

In a new writeup, Amazon's security team links the September hijack of the widely used npm packages debug and chalk to Sapphire Sleet, a hacking crew that works for the North Korean government. npm is the giant public library where JavaScript developers grab ready-made building blocks for their apps, so a poisoned package there can end up inside thousands of other products within hours.

The Hacker News first flagged the attribution shift.

What actually happened in September?

A maintainer, one of the volunteers who looks after these free code libraries, was tricked by a phishing email, meaning a fake message that pretended to come from npm and sent them to a lookalike login page. The attackers grabbed the login details, signed in as the maintainer, and pushed new versions of the packages with extra code hidden inside.

That extra code was a wallet drainer: a script that quietly hunts for cryptocurrency wallets on the machine running it and empties them into an attacker-controlled address.

At least 18 packages were tampered with. Debug and chalk are the headliners because almost every modern JavaScript project pulls them in, often without the developer realising. Together they account for over 2 billion downloads a week.

Why does the North Korea link matter?

Because it changes the motive, and the response. Ordinary criminal crews steal crypto to spend it. North Korean crews steal crypto to fund the state, which is under heavy international sanctions. That puts victims and any firm that unknowingly moved the stolen funds into the orbit of the US Treasury's Office of Foreign Assets Control, the agency that enforces sanctions.

The original disclosures from security vendors Aikido and Wiz described the mechanics of the attack in detail but stopped short of naming a country. Amazon's team says its own telemetry, plus overlaps with infrastructure and tooling seen in earlier Sapphire Sleet operations, point to the same group Microsoft has tracked for years targeting cryptocurrency firms and developers.

The incident at a glance

What should developers and users do now?

If you or your team installed debug or chalk in early September 2025, check your lockfiles for the malicious versions listed in the original Aikido and Wiz advisories and roll back to a clean release. Rotate any wallet keys or API tokens that touched a build machine during that window.

For anyone running a crypto wallet on a developer laptop, treat it as potentially exposed and move funds to a fresh wallet on a clean device.

Organisations that publish packages should turn on mandatory two-factor authentication for every maintainer account and switch to hardware keys where possible. A phished password alone should not be enough to poison code that ships to two billion downloads a week.