Amazon Traces September npm Hijack of Debug and Chalk to North Korean Hackers

Key points

• Amazon has attributed the September 2025 takeover of the popular npm packages debug and chalk to North Korean state hackers tracked as Sapphire Sleet.
• The attack began when a package maintainer was phished through a fake npm login page, letting the attackers push malicious updates.
• At least 18 packages were poisoned, with the two headliners pulling more than 2 billion downloads a week between them.
• The injected code was a wallet drainer designed to steal cryptocurrency from developers and users who ran the tainted versions.
• Original reports from security firms Aikido and Wiz did not name a country; Amazon's finding is the first public attribution.

For ten months, one of the largest software supply-chain incidents of 2025 read as a straightforward crypto heist. Amazon now says it wasn't.

In a new writeup, Amazon's security team links the September hijack of the widely used npm packages debug and chalk to Sapphire Sleet, a hacking crew that works for the North Korean government. Npm is the giant public library where JavaScript developers grab ready-made building blocks for their apps, so a poisoned package can end up inside thousands of other products within hours. The Hacker News first flagged the attribution shift. We covered Sapphire Sleet's activity starting 30 July, when lookalike JavaScript packages were found opening back doors on developers' machines.

What actually happened in September?

A maintainer was tricked by a phishing email, a fake message that sent them to a lookalike npm login page. The attackers grabbed those credentials, signed in as the maintainer, and pushed new package versions with extra code hidden inside.

That extra code was a wallet drainer: a script that quietly hunts for cryptocurrency wallets on the machine running it and empties them into an attacker-controlled address. At least 18 packages were tampered with. Debug and chalk are the headliners because almost every modern JavaScript project pulls them in, often without the developer realising. Together they account for over 2 billion downloads a week.

Why does the North Korea link matter?

It changes the motive, and the response. Ordinary criminal crews steal crypto to spend it. North Korean crews steal crypto to fund the state, which is under heavy international sanctions. That puts victims and any firm that unknowingly moved the stolen funds into the orbit of the US Treasury's Office of Foreign Assets Control, the agency that enforces sanctions. That's a consequence most security post-mortems on this incident skipped entirely.

The original disclosures from Aikido and Wiz described the mechanics in detail but stopped short of naming a country. Amazon's team says its own telemetry, plus overlaps with infrastructure and tooling seen in earlier Sapphire Sleet operations, point to the same group Microsoft has tracked for years targeting cryptocurrency firms and developers.

The incident at a glance

Should you worry?

If you installed debug or chalk in early September 2025, check your lockfiles against the malicious versions listed in the Aikido and Wiz advisories and roll back to a clean release. Rotate any wallet keys or API tokens that touched a build machine during that window. If you run a crypto wallet on a developer laptop, treat it as potentially exposed and move funds to a fresh wallet on a clean device.

Organisations that publish packages should require two-factor authentication for every maintainer account and switch to hardware keys where possible. A phished password alone shouldn't be enough to poison code shipping to two billion downloads a week.