Amazon Attribution Moves npm Hijack Risk Back To Maintainer Accounts

A North Korea attribution for the debug and chalk npm hijack changes the incident from a one-off wallet theft into part of a longer maintainer-account risk pattern.

The Hacker News reported that Amazon Threat Intelligence now connects the September 2025 compromise to Sapphire Sleet, while the public evidence still leaves some package-level links unresolved.

Amazon Threat Intelligence said in its July 29 research that the same group behind the March 2026 axios compromise was responsible.

Reports from Aikido and Wiz put the earlier debug and chalk incident across at least 18 packages with more than 2 billion weekly downloads, after a phishing-led npm compromise placed wallet-draining code in the package chain.

Attribution Extends The npm Supply-Chain Timeline

The new assessment reaches beyond the axios case that Google tied to UNC1069 and Microsoft tied to Sapphire Sleet.

Amazon also connects a smaller March 2025 package, typo-crypto, to the same activity cluster, placing a low-download test package before the larger axios incident.

The campaigns share a dependency on trusted developer paths rather than a single software flaw.

Maintainer phishing, malicious package updates and registry trust all sit inside the attack chain, so rotating credentials after an account compromise may not remove already-published malicious code from build systems, browser bundles or local caches.

Package Records Leave Some Links Unproven

The evidence is uneven across the packages.

The axios attribution has support from Google and Microsoft, while the debug and chalk link depends on Amazon's tradecraft comparison and command-and-control indicators.

No other public vendor report in the record named an actor for debug, chalk or typo-crypto.

The package record for typo-crypto also complicates the update narrative.

The registry entry checked on July 30, 2026, showed version 4.3.0 as still published and installable.

Its only listed release landed on March 31, 2025, and the creation and publication timestamps were separated by 204 milliseconds.

Amazon listed the registry timestamps as a first-publish sequence, and the available public package record does not list an earlier clean version.

Amazon's indicator list has another limitation.

The public indicators contain a mismatch between the SHA256 value Amazon labels as the package hash and the files served in the tarball, while core.js still contains the trigger value and XOR key named in the research.

The package-level evidence chain remains unreconciled for every compromise in the public record.

Registry Changes Narrow One Delivery Path

The npm ecosystem has already changed some defaults. npm v12, shipped on July 8, disables dependency lifecycle scripts by default, reducing the post-install route used in the axios compromise.

The report said that the registry also began scanning newly published packages for malware on July 28 before they become installable.

The new defaults narrow one execution route, but account takeover remains a separate supply-chain problem for debug, chalk and axios.

Aikido's comments to The Hacker News separated the debug and chalk method from lifecycle or install scripts, while axios and Mastra used that route.

Socket's comment to the outlet put the remaining entry point at the trusted maintainer account after social engineering.

For security teams, the operating record points to account protection, package provenance and cache review as one response problem.

Amazon's public post does not specify which evidence ties each older npm compromise to Sapphire Sleet.