Amazon links npm package hijacks to North Korean threat actor

Amazon has attributed the September 2025 hijack of the widely used npm packages debug and chalk to North Korea's Sapphire Sleet threat group. The Hacker News and CyberScoop report that the incident, which sat in the public record for ten months as a cryptocurrency theft campaign, involved a maintainer being phished through a lookalike npm domain. A wallet-draining script was subsequently pushed into at least 18 packages, which collectively receive more than 2 billion weekly downloads. Amazon's threat intelligence team traced domain records from the attack to an earlier, smaller compromise by the same group, confirming a pattern of supply chain targeting. The attribution provides additional context on the operational methods and persistence of North Korean threat actors in targeting open-source software ecosystems.

Why this matters for UK organisations

This incident underscores the sustained and sophisticated nature of supply chain attacks targeting open-source software. The npm ecosystem is foundational to modern web development, and the packages involved in this incident are dependencies in countless enterprise applications, internal tools and commercial products used across UK organisations. The fact that the compromise went undetected for ten months, and that attribution took significant investigative effort, highlights how difficult it is to identify and respond to supply chain attacks in real time. The involvement of a nation-state actor also indicates that these attacks are not opportunistic, but part of a deliberate and well-resourced campaign. For organisations that rely on open-source dependencies, this is a reminder that supply chain risk is not limited to commercial vendors, and that the same rigour applied to third-party software should extend to open-source components. The incident also highlights the importance of software bill of materials practices, dependency monitoring, and the ability to quickly identify and respond to compromised packages when they are discovered.

What to review

Organisations should review how open-source dependencies are managed, whether software bill of materials practices are in place, and how quickly the organisation can identify and respond to compromised packages. This includes confirming whether dependency management tools are in use, whether dependencies are regularly reviewed and updated, and whether the organisation has visibility into the full dependency tree of applications and services. It is also worth reviewing whether development and build environments have appropriate controls to limit the impact of a compromised dependency, such as sandboxing, code review, automated testing and integrity checks. Organisations should consider whether they have processes in place to monitor for security advisories related to open-source dependencies, and whether those advisories are acted on promptly. For organisations that develop software, it is sensible to review whether dependencies are pinned to specific versions, whether updates are tested before deployment, and whether there is a clear process for responding to supply chain incidents when they are disclosed.

Source: The Hacker News