Full Report
Amazon linked multiple high-profile open-source software supply chain attacks targeting the Node Package Manager (npm) ecosystem to North Korean hackers. [...]
Analysis Summary
# Threat Actor: Sapphire Sleet
## Attribution & Identity
* **Primary Name:** Sapphire Sleet
* **Aliases:** BlueNoroff, Stardust Chollima
* **Known Associations:** Democratic People's Republic of Korea (DPRK / North Korea)
* **Attribution Confidence:** Medium (based on TTPs, C2 infrastructure, and operational similarities)
## Activity Summary
Amazon researchers linked Sapphire Sleet to a series of high-profile supply chain attacks targeting the Node Package Manager (npm) ecosystem between 2025 and 2026:
* **March 2025:** Trojanization of the `typo-crypto` package (assessed as a testing ground).
* **September 2025:** Compromise of the widely used `debug` and `chalk` packages, affecting approximately 10% of cloud environments within two hours of deployment.
* **March 2026:** Compromise of the `axios` package (100 million+ weekly downloads) to drop cross-platform malware.
## Tactics, Techniques & Procedures
* **Social Engineering:** Targeting package maintainers to gain account access or influence.
* **Account Takeover (ATO):** Hijacking maintainer accounts to publish malicious updates.
* **Supply Chain Compromise:** Injecting malicious code into legitimate, highly-distributed open-source libraries.
* **Strategic Trust Building:** Spending months contributing to projects or maintaining benign libraries to establish a reputation before introducing malicious code.
* **Modular Payload Distribution:** Splitting malicious functionality across multiple seemingly benign packages to evade detection.
* **Decoupled Execution:** Relying on external scripts or remote servers to weaponize packages after installation.
* **Anti-Analysis & Evasion:**
* Environment-aware payloads that delay execution unless a production or developer environment is detected.
* Use of multi-stage payloads with remotely fetched encryption keys to hinder static analysis.
* **Slopsquatting:** Registering package names frequently hallucinated by AI coding assistants.
* **AI-Enhanced Operations:** Using AI to generate convincing documentation, code, and fake maintainer identities.
## Targeting
* **Sectors:** Technology, Software Development, Cloud Infrastructure.
* **Geography:** Global (targeting the open-source software supply chain).
* **Victims:**
* **Direct:** Package maintainers of `typo-crypto`, `debug`, `chalk`, and `axios`.
* **Downstream:** Cloud environments (approx. 10% of all cloud environments impacted during the 2025 surge) and millions of developers using the npm ecosystem.
## Tools & Infrastructure
* **Malware:** Cross-platform malware dropped via trojanized npm packages.
* **Infection Vectors:** Poisoned updates for `debug`, `chalk`, `axios`, and `typo-crypto`.
* **Infrastructure:** Noted use of specific C2 infrastructure (no specific domains or IPs provided in the text, but Amazon notes a shared C2 pattern across campaigns).
## Implications
Sapphire Sleet is shifting from direct financial heists (crypto-exchanges) to broad supply chain "watering hole" attacks. By targeting the foundations of the modern web (npm libraries with billions of downloads), they gain indirect access to a vast pool of potential downstream victims. Their use of "long-con" tactics—building trust over months—and AI-enhanced social engineering represents a significant escalation in the sophistication of state-sponsored supply chain threats.
## Mitigations
* **Account Security:** Enforce Multi-Factor Authentication (MFA) for all package maintainers and developers.
* **Dependency Management:** Use package-lock files and integrity hashes to prevent the automatic pulling of unauthorized versions.
* **Behavioral Monitoring:** Monitor for unexpected network connections or external script execution from build environments or node processes.
* **Code Review:** Rigorous auditing of third-party dependency updates, especially those involving changes to build scripts or external fetches.
* **Sandbox Analysis:** Run dependency installations in isolated, non-production environments to test for environment-aware triggers.
* **AI Awareness:** Vet code suggested by AI assistants to ensure dependencies exist and are legitimate (to counter "slopsquatting").