Affected Systems

npm packages debug, chalk, axios, typo-crypto, and Mastra (over 2 billion weekly downloads combined). Attacks spanned March 2025 through March 2026. Maintainer accounts compromised via phishing; malicious code injected to steal cryptocurrency wallet credentials. typo-crypto@4.3.0 remains installable as of July 30, 2026.

Exploitation Status

Active exploitation confirmed. Amazon attributes three campaigns (September 2025 debug/chalk, March 2026 axios, and March 2025 typo-crypto) to North Korea's Sapphire Sleet (aka UNC1069, BlueNoroff, STARDUST CHOLLIMA). Google and Microsoft independently attributed axios. Wallet-draining code deployed; Socket reported ~$600 stolen in September 2025. Malicious typo-crypto@4.3.0 still published and installable on npm registry as of July 30, 2026.

Business Impact

Organizations using affected npm packages risk cryptocurrency wallet theft and potential secondary compromise. The debug and chalk attack used browser-side interception (fetch, XMLHttpRequest, wallet API hooks) with no machine persistence. axios and Mastra used post-install hooks. typo-crypto used a trigger-based payload (hash input starting with 0098273) that fetches OS-specific second stage from C2 (npmjs[.]store, 216[.]74[.]123[.]126). Attribution published 10-16 months post-incident; evidence gaps remain. npm v12 (July 8, 2026) disables lifecycle scripts by default, reducing post-install hook risk but not browser-side attacks.

Urgency

🟠 Within 24 hours

Recommended Actions

  • ["Audit package-lock.json and node_modules for debug, chalk, axios, typo-crypto, and Mastra installed between March 2025 and March 2026; compare hashes against known-good versions from npm advisory timelines."]
  • ["Block network indicators npmjs[.]store and 216.74.123.126 at perimeter and endpoint firewalls; search proxy and DNS logs for historical connections since March 2025."]
  • ["Scan browser extension stores and developer workstations for persistence mechanisms targeting fetch, XMLHttpRequest, or Web3 wallet APIs; review browser DevTools console logs for unexpected transaction address rewrites."]
  • ["Remove typo-crypto@4.3.0 if present (still installable as of July 30, 2026); verify no packages depend on it via npm ls typo-crypto or equivalent dependency tree analysis."]
  • ["Upgrade to npm v12 or later to disable lifecycle scripts by default; enforce use of --ignore-scripts flag in CI/CD pipelines for npm install operations on older versions."]

---

# Threat Actor Context

Actor Profile

Sapphire Sleet is a North Korean state-sponsored threat actor attributed by Microsoft, with overlaps tracked by other vendors as UNC1069 (Google), STARDUST CHOLLIMA, BlueNoroff, Alluring Pisces, CageyChameleon, and CryptoCore. The group is linked to APT38/NICKEL GLADSTONE/BeagleBoyz operations and is financially motivated, targeting cryptocurrency assets through software supply chain compromises. Amazon attributes with medium confidence a series of npm package hijacks spanning March 2025 through March 2026 to this actor, including the high-profile September 2025 compromise of debug and chalk packages (over 2 billion weekly downloads combined). The actor demonstrates sophisticated social engineering capabilities, compromising trusted maintainers through phishing campaigns using lookalike npm domains to inject wallet-draining malware into widely-used open source packages.

TTPs (Tactics, Techniques, Procedures)

Initial Access: T1189 (Drive-by Compromise) via phishing through lookalike npm domains to compromise package maintainers. Execution: T1059.003 (Command and Scripting Interpreter: Windows Command Shell) for payload delivery; browser-side JavaScript injection hooking fetch, XMLHttpRequest, and wallet APIs to intercept and rewrite cryptocurrency transaction addresses. Defense Evasion: T1140 (Deobfuscate/Decode Files or Information) using base64 over XOR cipher keyed to '01042025'; T1036.006 (Masquerading: Space after Filename) and package impersonation (core.js posing as core-js, typo-crypto mimicking crypto-js); T1070.004 (Indicator Removal: File Deletion) capabilities. Discovery: T1083 (File and Directory Discovery), T1518.001 (Security Software Discovery). Persistence: Post-install hooks in axios/Mastra campaigns; trigger-based activation in typo-crypto (hash input beginning '0098273'). Command and Control: Hardcoded C2 infrastructure at npmjs[.]store and 216[.]74[.]123[.]126; AstrillVPN node reuse (WAVESHAPER.V2 backdoor in axios). Collection: Credential harvesting via wallet interception, netting approximately $600 from September 2025 wallets.

Targets & Patterns

Sapphire Sleet targets the software development ecosystem with specific focus on high-impact npm packages in the JavaScript/Node.js supply chain. Primary victims include open source maintainers of widely-distributed packages (debug, chalk, axios with 2+ billion combined weekly downloads) and cryptocurrency users. The actor demonstrates a progression from low-download test packages (typo-crypto in March 2025) to high-value targets, indicating reconnaissance and capability refinement. Targeting pattern shows financial motivation through cryptocurrency theft rather than traditional espionage, consistent with North Korean revenue generation operations. The campaigns span software development tooling, cryptocurrency libraries, and developer infrastructure, exploiting the trust model of package registries and the broad reach of dependency chains. Geographic focus is global given the nature of open source distribution, with particular impact on cryptocurrency holders and organizations using affected packages in production environments.

Historical Context

Amazon's attribution connects four campaigns across twelve months (March 2025 - March 2026): typo-crypto (March 2025, test run with low downloads), debug/chalk hijack (September 2025, 2+ billion weekly downloads), axios compromise (March 2026), and Mastra. Google independently attributed axios to UNC1069 citing WAVESHAPER.V2 backdoor and reused AstrillVPN infrastructure; Microsoft attributed the same to Sapphire Sleet, resolving the naming gap across vendor taxonomies. The typo-crypto package was identified retroactively through domain analysis during the axios investigation, published as OSV record MAL-2026-3400 on May 8, 2026, but remained installable as of July 30, 2026. Aikido disputes Amazon's claim of novel attribution, stating the North Korea link has been discussed in supply chain security community circles, blog posts, and conference talks for months. The actor shows tradecraft evolution: typo-crypto used trigger-based activation, debug/chalk employed browser-side interception without install scripts, while axios/Mastra relied on npm post-install hooks. This progression demonstrates OPSEC adaptation and testing of multiple compromise vectors. The broader APT38/BlueNoroff cluster is known for financially motivated operations including the 2016 Bangladesh Bank heist and ransomware campaigns (T1486, KillDisk malware).

Defensive Recommendations

  • Monitor npm package updates for unexpected maintainer changes or publishing account mismatches; implement package lock file integrity checks and verify publisher identity before accepting updates to critical dependencies
  • Detect T1140 obfuscation patterns: scan for base64-encoded payloads with XOR cipher operations in JavaScript dependencies; hunt for hardcoded keys like '01042025' and suspicious trigger values ('0098273') in package code
  • Block network indicators npmjs[.]store and 216[.]74[.]123[.]126; monitor for connections to lookalike npm domains and AstrillVPN nodes; implement egress filtering for package installation processes
  • Deploy browser-side detection for T1059 JavaScript execution: monitor for hooks to fetch, XMLHttpRequest, and Web3/wallet APIs that rewrite transaction addresses; implement Content Security Policy to restrict runtime code modification
  • Enforce npm v12+ with dependency lifecycle scripts disabled by default (--ignore-scripts flag); require explicit approval for post-install hooks; scan for packages with install scripts targeting cryptocurrency operations or credential access (T1056.001)

---

# Geopolitical Context

Geopolitical Context

The attribution of the debug and chalk npm package compromises to North Korea's Sapphire Sleet (also tracked as UNC1069, BlueNoroff, STARDUST CHOLLIMA) extends a documented pattern of DPRK-linked cyber operations targeting cryptocurrency infrastructure and software supply chains. These campaigns appear consistent with North Korea's broader strategy of using cyber operations to generate revenue in the face of international sanctions. The incidents span March 2025 through March 2026, affecting packages with over 2 billion weekly downloads collectively. The attribution, made ten to sixteen months post-incident, reflects the challenge of linking supply chain compromises to state-nexus actors when initial indicators focus on financial motivation rather than geopolitical objectives. The overlap with Google's UNC1069 attribution for the axios compromise and Microsoft's Sapphire Sleet designation suggests convergence among threat intelligence providers on North Korean involvement in this campaign cluster, though Amazon's evidentiary basis for linking the September 2025 incidents remains partially disclosed.

State Actor Alignment

Amazon assesses with medium confidence that North Korea's Sapphire Sleet threat actor conducted the September 2025 npm hijacks of debug and chalk, as well as the March 2025 typo-crypto compromise and March 2026 axios incident. Microsoft tracks this activity as Sapphire Sleet, which overlaps with entities other vendors designate as UNC1069 (Google), STARDUST CHOLLIMA, BlueNoroff, Alluring Pisces, CageyChameleon, and CryptoCore. These groups are linked to North Korean state interests, particularly revenue generation through cryptocurrency theft to circumvent international sanctions imposed by the United States, European Union, and United Nations Security Council. The financially motivated nature of the attacks—targeting wallet-draining and cryptocurrency infrastructure—aligns with established DPRK cyber doctrine that blurs the line between state espionage, sanctions evasion, and criminal activity. No formal government attribution or sanctions designation has been announced in connection with these specific npm incidents as of the reporting date.

Business Impacty pro region

The compromise of widely used open-source packages affects the global software development ecosystem, with particular implications for organizations in North America, Europe, and Asia that rely on npm dependencies. The 2+ billion weekly downloads across affected packages indicate potential exposure spans financial services, cryptocurrency platforms, and technology firms worldwide. For European entities, the incident underscores supply chain risk in the context of EU sanctions against North Korea and the bloc's emerging cyber resilience frameworks (NIS2, CRA). The targeting of cryptocurrency infrastructure may disproportionately affect jurisdictions with significant digital asset activity, including the United States, United Kingdom, Singapore, and South Korea. The delayed attribution—ten to sixteen months post-compromise—suggests that many affected organizations may have rotated credentials, rebuilt systems, or remained unaware of exposure during the window when malicious code was active. The incident reinforces concerns about maintainer account security and the concentration of trust in small numbers of open-source contributors, a systemic risk that transcends national borders and affects critical infrastructure globally.

Forecast

If North Korean cyber actors continue to refine supply chain compromise techniques—particularly social engineering of trusted maintainers and trojanized package deployment—the open-source ecosystem is likely to face sustained targeting, with cryptocurrency and financial technology sectors remaining priority objectives. The publication of Amazon's attribution may prompt increased scrutiny of npm and other package registries by threat intelligence teams, potentially leading to discovery of additional dormant or low-download packages seeded as test runs or sleeper assets. If npm's July 2026 shift to disable lifecycle scripts by default gains adoption, future campaigns may increasingly rely on browser-side interception or application-layer hooks rather than install-time execution, complicating detection. Should Western governments issue formal attributions or impose additional sanctions in response to these incidents, North Korean operators may adjust operational security practices, rotate infrastructure, or shift to alternative ecosystems (PyPI, RubyGems, container registries). If the evidentiary gaps cited by analysts remain unresolved, confidence in retrospective attribution may erode, complicating coordinated response and policy development. Organizations that consumed affected packages during compromise windows should anticipate that credential and wallet compromise may surface in secondary incidents over the coming months.