Amazon ties North Korean group to axios, debug and chalk npm compromises
Amazon says a single North Korean state-linked hacking group was behind several compromises of popular JavaScript packages on the npm registry, including the March 2026 hijacking of axios, a library downloaded more than 100 million times a week.
The attribution, published July 29, connects attacks that hit software supply chains used by developers in Canada and around the world. When a widely used package is poisoned, every project that automatically pulls the latest version can receive the malicious code.
What Amazon found
In a post on the AWS Security Blog, Amazon chief information security officer CJ Moses said Amazon Threat Intelligence assesses with medium confidence that the activity belongs to a group tracked under names including Sapphire Sleet, Stardust Chollima, BlueNoroff, CageyChameleon and Alluring Pisces.
Amazon linked three incidents involving four packages:
- typo-crypto, March 2025: a small campaign with a trojanized file, which Amazon believes was a testing ground. Its malware downloaded a second-stage payload and ran different code on Windows, macOS and Linux.
- debug and chalk, September 2025: linked to this actor publicly for the first time. Amazon cited Wiz Research estimating that about one in 10 cloud environments was affected within a two-hour window.
- axios, March 2026: previously attributed to the same group.
In the debug, chalk and axios cases, the attackers socially engineered a trusted maintainer and then published a malicious update. Shared techniques included trojanized packages, scripts that run automatically on install and reused code.
"For the DPRK, this is a financially motivated pattern," Moses wrote, adding that compromising a small number of highly popular packages gains potential access to thousands of downstream environments, MeriTalk reported.
A warning about scanners and AI
Amazon cautioned that a clean scan or sandbox result is not proof a package is safe, because attackers now tailor payloads to evade analysis. It also warned that AI-based code reviewers should be treated as part of the attack surface, since prompt-injection text can be hidden in package files. Amazon shared the malicious typo-crypto package through the open-source vulnerabilities database, OSV, where it is tracked as MAL-2026-3400.
What to do
- Pin dependency versions and use lockfiles instead of automatically pulling the latest releases.
- Disable or restrict install scripts in build pipelines where possible.
- Map which applications depend on axios, debug and chalk, and confirm affected versions were never installed.
- Check network logs for the indicators Amazon published, including the domain npmjs[.]store.
