Amazon attributes debug, chalk, and axios supply chain attacks to North Korea's Sapphire Sleet

Amazon's security team has attributed a connected series of npm supply chain attacks to Sapphire Sleet, the North Korean threat actor also known as BlueNoroff and Stardust Chollima. The campaign ran from March 2025 through March 2026 and targeted four packages: typo-crypto, debug, chalk, and axios. Attribution is assessed at medium confidence based on shared tactics, infrastructure, and operational patterns.

All four compromised versions are covered in Attestd and return risk_state: critical with supply_chain.compromised: true. This post shows the live API responses and places the campaign in the context of Sapphire Sleet's broader npm activity.

The campaign chain#

Amazon describes the campaign as deliberately sequenced. The actor did not attempt the high-value packages first.

March 2025: typo-crypto as rehearsal

[email protected] was the opening move. Amazon characterises this as a testing ground, a low-visibility compromise used to validate the actor's access mechanism and payload delivery before moving to targets with meaningful scale. typo-crypto is a small package. The damage radius of a mistake here is contained. That appears to have been the point.

September 8, 2025: debug and chalk

The rehearsal was followed six months later by the most consequential npm supply chain attacks on record by download volume. The actor compromised the GitHub account of Qix, a maintainer with publish rights to both debug and chalk, through a phishing campaign.

debug has approximately 300 million weekly downloads. chalk has approximately 400 million. Together they reach an estimated 10% of cloud environments within two hours of a malicious publish. The compromised versions, [email protected] and [email protected], were on the registry for a brief window. The exposure was not brief enough.

March 31, 2026: axios

The actor returned six months later with the axios compromise. A fake Microsoft Teams error message was used to social engineer the axios maintainer into running a malicious script that harvested their npm credentials. The compromised versions, 1.14.1 and 0.30.4, were published on March 31. axios has over 100 million weekly downloads. This incident had already received public attribution to DPRK-linked actors before Amazon's report connected it to the earlier campaign.

What Attestd returns#

[email protected]#

curl "https://api.attestd.io/v1/check?product=debug&version=4.4.2" \
  -H "Authorization: Bearer $ATTESTD_API_KEY"

{
  "product": "debug",
  "version": "4.4.2",
  "supported": true,
  "risk_state": "critical",
  "risk_factors": ["supply_chain_compromised"],
  "confidence": 0.95,
  "cve_ids": [],
  "supply_chain": {
    "compromised": true,
    "sources": ["osv"],
    "malware_type": "malware",
    "description": "Malicious code in debug (npm)",
    "compromised_at": "2025-09-08T14:26:51Z",
    "removed_at": null
  },
  "supply_chain_monitored": true
}

[email protected]#

curl "https://api.attestd.io/v1/check?product=chalk&version=5.6.1" \
  -H "Authorization: Bearer $ATTESTD_API_KEY"

{
  "product": "chalk",
  "version": "5.6.1",
  "supported": true,
  "risk_state": "critical",
  "risk_factors": ["supply_chain_compromised"],
  "confidence": 0.95,
  "cve_ids": [],
  "supply_chain": {
    "compromised": true,
    "sources": ["osv"],
    "malware_type": "malware",
    "description": "Malicious code in chalk (npm)",
    "compromised_at": "2025-09-08T17:11:19Z",
    "removed_at": null
  },
  "supply_chain_monitored": true
}

Both compromised versions remain on the registry with removed_at: null. No CVEs, no vulnerability record. risk_state: critical from the supply chain signal alone.

[email protected]#

curl "https://api.attestd.io/v1/check?product=axios&version=1.14.1" \
  -H "Authorization: Bearer $ATTESTD_API_KEY"

{
  "product": "axios",
  "version": "1.14.1",
  "supported": true,
  "risk_state": "critical",
  "risk_factors": ["supply_chain_compromised"],
  "confidence": 0.95,
  "cve_ids": [],
  "supply_chain": {
    "compromised": true,
    "sources": ["osv"],
    "malware_type": "malware",
    "description": "Malicious code in axios (npm)",
    "advisory_url": "https://github.com/axios/axios/issues/10604",
    "compromised_at": "2026-03-31T03:15:49Z",
    "removed_at": null,
    "provenance": false
  },
  "supply_chain_monitored": true
}

The axios response includes provenance: false, distinct from the null value on debug and chalk. This reflects the provenance signal working as intended: axios publishes provenance attestations on its releases. The compromised version 1.14.1 does not carry a valid attestation, because it was published using a hijacked maintainer account rather than the legitimate release pipeline. The absence of provenance on a package that normally provides it is a signal in its own right. [email protected] returns the same compromised shape on the legacy 0.x line.

[email protected]#

curl "https://api.attestd.io/v1/check?product=typo-crypto&version=4.3.0" \
  -H "Authorization: Bearer $ATTESTD_API_KEY"

{
  "product": "typo-crypto",
  "version": "4.3.0",
  "supported": true,
  "risk_state": "critical",
  "risk_factors": ["supply_chain_compromised"],
  "confidence": 0.95,
  "cve_ids": [],
  "supply_chain": {
    "compromised": true,
    "sources": ["osv"],
    "malware_type": "malware",
    "description": "Malicious code in typo-crypto (npm)",
    "compromised_at": "2026-05-08T19:23:07Z",
    "removed_at": null
  },
  "supply_chain_monitored": true
}

Note on the typo-crypto timestamp: Amazon places the campaign activity in March 2025. The compromised_at reflects the OSV and Amazon Inspector advisory publication date in May 2026, not the original compromise. Use Amazon's reporting for the campaign timeline, not this field, for typo-crypto specifically.

The Sapphire Sleet thread in Attestd's coverage#

Sapphire Sleet has appeared in this detection ledger three times now.

In June 2026, the @mastra npm scope attack compromised 145 packages across Mastra AI's npm presence. Attribution to Sapphire Sleet was confirmed on disclosure day. All 145 packages were covered.

On July 28, 2026, two @joyfill beta packages were compromised using the same blockchain C2 infrastructure seen in ViteVenom. Socket confirmed North Korean attribution, consistent with Sapphire Sleet operational patterns. Coverage was confirmed the following morning.

Today Amazon has connected typo-crypto, debug, chalk, and axios to the same actor across a campaign running from March 2025 to March 2026. All four compromised versions return risk_state: critical.

The actor has been operating against the npm ecosystem continuously. The three incidents covered in this ledger span June 2026 through July 2026. The Amazon attribution extends the timeline back to March 2025 and connects incidents that were previously reported as separate events.

The trends Amazon documented#

Amazon's report identifies several patterns emerging across recent supply chain attacks. Three are worth highlighting in the context of how Attestd signals these.

Environment-aware malware. The Joyfill and ViteVenom payloads both evade known analysis environments. A payload that behaves differently depending on hostname or environment variable values cannot be reliably caught by sandbox-based detection. Attestd's supply_chain.compromised signal is independent of payload execution: the flag is set based on the advisory record, not on whether the malware ran.

Decoupled payloads. Blockchain C2 and externally fetched configuration mean the malicious content can change after a package is installed. A hash-based block on the original install file does not protect against a retasked payload. The compromised: true signal persists regardless of what the payload currently fetches.

Slopsquatting. Amazon explicitly names AI-hallucinated package names as an emerging attack vector, registering names that AI coding assistants invent before the attacker publishes malicious content to them. Attestd's typosquat signal with kind: hallucination addresses exactly this case. The HalluSquatting threat model is now in an Amazon security attribution report.

Credit and attribution#

Full analysis: Amazon Identifies North Korean Hacker Group Behind Open Source Supply Chain Attacks — Amazon Security, July 30, 2026.

Attribution to Sapphire Sleet is assessed at medium confidence per Amazon's own characterisation.

Coverage#

[email protected], [email protected], [email protected], [email protected], and [email protected] are all covered and return risk_state: critical with supply_chain.compromised: true. Responses above are live from the production API as of July 31, 2026.

API documentation: attestd.io/docs. Detection ledger: github.com/attestd-io/detection-ledger. Mastra coverage: attestd.io/blog/mastra-ai-npm-sapphire-sleet. JoyFill coverage: attestd.io/blog/joyfill-blockchain-c2-campaign.