Full Report
Amazon has tied the September 2025 hijack of the npm packages debug and chalk to North Korea. For ten months, the incident sat in the public record as crypto theft: a maintainer phished through a lookalike npm domain and a wallet-draining script pushed into at least 18 packages carrying more than 2 billion weekly downloads between them. The original Aikido and Wiz reports did not attribute the
Analysis Summary
# Threat Actor: Sapphire Sleet
## Attribution & Identity
**Sapphire Sleet** is a North Korean state-sponsored threat group. Amazon Threat Intelligence linked this actor to several major npm supply chain attacks with medium confidence. The group is tracked by other security vendors under various names:
* **Aliases:** UNC1069, STARDUST CHOLLIMA, BlueNoroff, Alluring Pisces, CageyChameleon, CryptoCore.
* **Associations:** Closely associated with North Korean financial theft operations (Lazarus Group umbrella).
## Activity Summary
The actor has engaged in a multi-stage campaign targeting the open-source ecosystem between 2025 and 2026:
* **March 2025:** Published a trojanized package `typo-crypto` as a "test run" for tradecraft.
* **September 2025:** Hijacked the highly popular npm packages `debug` and `chalk` (with 2+ billion weekly downloads) to deploy wallet-draining scripts.
* **March 2026:** Compromised the `axios` npm package to deploy backdoors.
## Tactics, Techniques & Procedures
* **Social Engineering:** Phishing trusted package maintainers through lookalike domains (e.g., lookalike npm registry domains) to steal credentials.
* **Supply Chain Injection:** Publishing malicious updates to established, high-download npm packages.
* **Browser-Side Interception:** Hooking `fetch`, `XMLHttpRequest`, and wallet APIs to rewrite cryptocurrency transaction addresses in real-time.
* **Malicious Hooks:** Use of npm post-install hooks to trigger payloads (though notably absent in the `debug` and `chalk` incidents).
* **Payload Obfuscation:** Use of Base64 encoding and XOR ciphers (e.g., key `01042025`) to hide second-stage downloads.
* **MITRE ATT&CK IDs:**
* T1195.002 (Supply Chain Compromise: Compromise Software Dependencies and Development Tools)
* T1566.002 (Phishing: Spearphishing Link)
* T1557 (Interception)
* T1027 (Obfuscated Files or Information)
## Targeting
* **Sectors:** Cryptocurrency, Decentralized Finance (DeFi), Software Development.
* **Geography:** Global (via open-source distribution).
* **Victims:** Open-source maintainers; users of `debug`, `chalk`, and `axios` packages; cryptocurrency wallet holders.
## Tools & Infrastructure
* **Malware:**
* WAVESHAPER.V2 backdoor.
* `core.js`: A malicious file posing as the legitimate `core-js` library.
* A custom wallet-draining script.
* **Infrastructure:**
* `npmjs[.]store` (Malicious lookalike domain)
* `216[.]74[.]123[.]126` (C2 Server)
* AstrillVPN nodes for activity masking.
## Implications
This campaign demonstrates the extreme leverage North Korean actors gain by targeting "critical-path" open-source libraries. By compromising packages with billions of downloads, they achieve massive reach with minimal effort. The shift from simple "test runs" (`typo-crypto`) to hijacking foundational libraries (`debug`, `chalk`) indicates an escalating proficiency in supply chain operations focused on state-sponsored financial theft.
## Mitigations
* **For Maintainers:** Enable Mandatory Two-Factor Authentication (2FA) for npm accounts and use hardware security keys if possible.
* **For Developers:** Implement dependency pinning and use tools to audit the `node_modules` directory for known malicious versions (e.g., `MAL-2026-3400`).
* **Runtime Security:** Implement Content Security Policy (CSP) headers to prevent unauthorized scripts from communicating with unknown C2 domains from the browser.
* **Verification:** Utilize software composition analysis (SCA) tools to detect anomalies in package behavior, such as unexpected network requests during post-install hooks.