Amazon has officially attributed the September 2025 hijacking of npm packages, including debug and chalk, to North Korean cyber actors. This incident had initially been classified as a crypto theft involving a maintainer who was deceived into a phishing scheme, leading to the deployment of a wallet-draining script across over 18 packages with a combined weekly download volume exceeding 2 billion.
Investigation and Attribution
Initial reports from Aikido and Wiz did not link the hijacking to North Korea. However, Amazon Threat Intelligence, in a report released on July 29, suggested with moderate certainty that the perpetrators of the March 2026 axios breach were also responsible for this attack. Amazon’s researchers discovered a trojanized file within a lesser-known package called typo-crypto, dating back to March 2025, a year before its connection to axios was identified. This discovery was made while investigating a domain registered in 2025, which was brought to light during the axios inquiry.
Amazon’s analysis highlights similarities in tactics, techniques, and procedures (TTPs) across the campaigns. Despite relatively low download numbers for typo-crypto, Amazon interprets this as a preliminary test run. Their attribution spans four distinct packages over three separate campaigns, all of which share a common initial phase: gaining the trust of a maintainer through social engineering and subsequently releasing a compromised update.
Evidence and Challenges
Amazon has not reported any fresh compromises, but the scope of the response for packages like debug and chalk remains consistent with previously published methods. However, the evidence supporting Amazon’s attribution appears less substantial than their claims suggest. Their documentation mentions shared TTPs, trojanized packages, post-install hooks, and code reuse, yet fails to specify which pieces of evidence directly link each incident.
This lack of specificity is particularly significant for the debug and chalk incidents. Aikido and Wiz had documented browser-side interceptors affecting fetch, XMLHttpRequest, and wallet APIs, which altered transaction addresses before user authorization. Unlike the axios payload, this did not rely on an npm post-install hook, nor did typo-crypto, which awaited a specific trigger instead.
Industry Reactions and Future Outlook
Google and Microsoft have independently attributed the axios incident to UNC1069, also known as Sapphire Sleet. This group is linked to several aliases used by different cybersecurity vendors, including BlueNoroff and CryptoCore. Despite the discrepancy in naming conventions, Amazon remains the sole source attributing the debug, chalk, and typo-crypto incidents to North Korea. The official attribution for the axios incident was established within two days, while the others took considerably longer.
Amazon asserts these actions are financially motivated, with Socket reporting that the September operation netted approximately $600 in cryptocurrency. Amazon’s findings describe a malicious file, core.js, masquerading as the legitimate core-js package, which activated upon a specific hash input, leading to further system-specific payload execution.
The cybersecurity community is closely monitoring these developments, with npm implementing new measures to mitigate similar risks. As of July 8, npm has disabled dependency lifecycle scripts by default in version 12 and started scanning new package uploads for malware as of July 28. These efforts aim to close vulnerabilities exploited by the attackers, although challenges remain in fully securing the maintainer-compromise vector.
