North Korea's 'Sapphire Sleet' Linked to Widespread JavaScript Supply-Chain Attacks
Amazon Web Services attributes a series of sophisticated supply-chain attacks targeting popular JavaScript libraries on the npm registry to North Korea's 'Sapphire Sleet' threat actor.
Amazon Web Services (AWS) has identified a financially motivated North Korean nation-state threat actor, known as 'Sapphire Sleet' or 'Stardust Chollima,' as the likely perpetrator behind a series of supply-chain attacks targeting open-source JavaScript libraries hosted on the npm registry. The analysis, set for publication, links these attacks with high confidence to the Pyongyang regime, suggesting a coordinated and industrial-scale operation.
The compromised libraries include Axios, Debug, Chalk, and Typo-Crypto. According to CJ Moses, vice president of Amazon engineering, the same threat actor was observed behind all four incidents, utilizing identical Trojanized npm packages, reusing code, and employing consistent tactics, techniques, and procedures (TTPs). These TTPs include the use of automatic scripts that execute upon package installation, a common method for delivering malicious payloads.
Researchers at AWS detailed how the attackers gained the trust of maintainers for these open-source projects by offering genuine support, fixing bugs, responding to pull requests, and contributing to documentation. This approach allowed them to blend in as legitimate community members, a tactic that exploits the open-source ecosystem's reliance on collaboration and trust. Rick Anthony, a senior engineering leader at AWS, noted that the npm repository is a prime target due to its ubiquity in web development and its potential to interact with sensitive areas like Web3 protocols and cryptocurrency wallets.
The attack on the Typo-Crypto package in March 2025 is believed to have served as a test run for more ambitious operations, such as the later compromise of Axios, one of the most downloaded JavaScript libraries. This smaller-scale compromise allowed the threat actor to refine their TTPs before targeting a high-profile project with millions of weekly downloads.
North Korea is known for its state-sponsored hacking operations, often aimed at generating hard currency to fund its impoverished economy and military programs. The compromised packages are designed to steal cryptocurrency directly from user wallets or leverage infected machines for cryptocurrency mining. AWS observed that these attacks are becoming increasingly sophisticated, with malicious code often split across multiple interdependent packages, sometimes using encrypted blobs disguised as configuration files.
To evade detection, the attackers employ advanced techniques, such as ensuring their code does not run in sandboxed environments and embedding commands designed to fool artificial intelligence analysis tools into believing the code has already been reviewed and deemed clean. These methods highlight the evolving nature of supply-chain threats and the need for robust security measures throughout the software development lifecycle.
Despite the increasing sophistication of these attacks, AWS emphasized that enterprises should not abandon continuous integration and continuous deployment (CI/CD) practices. Instead, the focus should shift towards securing CI/CD pipelines with integrated scanning and rigorous security checks. Moses argued that slowing down CI/CD processes can paradoxically increase vulnerability by delaying the patching of known exploits.
The findings underscore the persistent threat posed by nation-state actors to the open-source software ecosystem. The ability of groups like Sapphire Sleet to infiltrate trusted repositories and compromise widely used libraries presents a significant risk to downstream users, necessitating enhanced vigilance and security practices from developers and organizations alike.
Amazon researchers have uncovered evidence that the North Korean-backed group, also known as UNC1069 or Sapphire Sleet, used the typo-crypto npm package compromise in March 2025 as a deliberate 'rehearsal' for its later, more high-profile attack on the axios library. This earlier campaign, along with separate compromises of the debug and chalk packages in September 2025, allowed the group to refine its social engineering tactics of gaining trust with package maintainers to publish malicious updates, testing its methods on less scrutinized targets before escalating to widely used software.
This new reporting details the specific npm packages compromised by the SAPPHIRE SLEET (also known as STARDUST CHOLLIMA, BlueNoroff, CageyChameleon, and Alluring Pisces) threat actor, including typo-crypto, debug, chalk, and axios, with the latter having over 100 million weekly downloads. The article further elaborates on the sophisticated techniques employed, such as layered encoding, splitting malicious activity across multiple packages, and social engineering to gain maintainer account access, providing a more granular view of the campaign's execution and evasion tactics.
Amazon Threat Intelligence has now attributed the September 2025 hijack of the popular npm packages 'debug' and 'chalk' to North Korea's Sapphire Sleet group, a finding not present in earlier analyses. While previous reports focused on the technical mechanism of wallet-draining scripts injected into numerous packages, Amazon's research suggests this incident may have served as a test run for the same group later observed compromising the 'axios' package. This new attribution adds a significant layer to the understanding of Sapphire Sleet's supply-chain attack campaign.
Amazon has now publicly linked the North Korean threat actor SapphireSleet to four separate compromises of popular JavaScript packages on the NPM repository, including the widely used 'axios' library. While previous reports had attributed the 'axios' compromise to North Korean hackers, Amazon's findings connect it to earlier incidents involving 'typo-crypto', 'debug', and 'chalk', and attribute all four to the same actor. The group reportedly gained access by socially engineering package maintainers to publish malicious updates, a tactic consistent with SapphireSleet's known reliance on social engineering over exploiting software vulnerabilities.
Amazon has now directly linked the Debug and Chalk npm package compromises to the Sapphire Sleet threat actor, also known as BlueNoroff and Stardust Chollima, providing further attribution beyond initial reports. The cloud giant's analysis indicates that the attackers gained access by socially engineering package maintainers and then published malicious updates, which were automatically distributed to a significant portion of cloud environments within hours. Amazon's attribution holds medium confidence, based on shared tactics, techniques, and procedures, command-and-control infrastructure, and operational similarities.
AWS has now officially attributed these npm supply chain attacks, including those targeting popular packages like 'axios', 'debug', 'chalk', and 'typo-crypto', to the North Korean threat group known as Sapphire Sleet. The cloud giant's threat intelligence team identified shared tactics, techniques, and procedures (TTPs) across these campaigns, such as the use of trojanized packages, post-install hooks, and code reuse, leading to this attribution with medium confidence.