More than 2 billion weekly downloads — that is the combined reach of the npm packages debug and chalk that were altered in a September 2025 supply-chain hijack now tied by Amazon Threat Intelligence to North Korea, according to research published July 29, 2026.
Amazon Threat Intelligence's attribution and timeline
Amazon Threat Intelligence published a July 29, 2026 assessment that links the September 2025 hijack of the npm packages debug and chalk, and a March 2025 trojanized package called typo-crypto, to the same actor it associates with the March 2026 axios compromise. Amazon characterizes its confidence in that linkage as "medium." The company says its attribution spans four named packages across three campaigns in twelve months and that all three campaigns began the same way: socially engineer a trusted maintainer, then publish an update.
Amazon also reported no new compromises in publishing the attribution; its write-up preserved the original response scope for debug and chalk — browser bundles and caches — and stated that only the attribution changed.
Technical artifacts Amazon describes: core.js, trigger values, and network indicators
Amazon described a malicious file named core.js that impersonated the legitimate core-js package inside a repository. The file reportedly triggers on a hash input beginning 0098273 and fetches an operating-system-specific second stage from a hardcoded command-and-control, obfuscated with base64 over an XOR cipher keyed to 01042025. Amazon named npmjs[.]store and 216[.]74[.]123[.]126 as network indicators associated with the activity.
The post links tradecraft across campaigns — trojanized packages, post-install hooks, code reuse, and overlapping command-and-control indicators — as the basis for its attribution. The Hacker News also reports that Socket told it the September wallet thefts yielded about $600.
Registry record for typo-crypto@4.3.0 and observable oddities
The open registry maintains a single published version of typo-crypto, typo-crypto@4.3.0, created and published on March 31, 2025 with the tarball and integrity hashes matching the registry record. The Hacker News checked the registry on July 30, 2026 and found the package still published and still installable; it declares no install script, so simply pulling it down will not on its own execute code.
Other details in the registry record raised questions: the publishing account does not match the package author field; the package description and keywords copy text from crypto-js (a different project), and the package appears to impersonate crypto-js at a version one release ahead of crypto-js's then-latest 4.2.0. The single-version record fits a package built to impersonate another project at first publish rather than a maintainer-compromise followed by an update.
The Hacker News also notes that the file Amazon cites, core.js, contains both the trigger value and the XOR key Amazon names; however, the hashes Amazon lists do not appear in the tarball. Amazon lists a SHA256 of core.js as the package hash, but that stated hash appears in no file in the tarball served by the registry.
Third-party attributions and how the axios case compares
Unlike the debug and chalk incidents, the March 2026 axios compromise drew independent attributions within days. Google attributed axios to UNC1069, citing the WAVESHAPER.V2 backdoor and an AstrillVPN node that had been used before. Microsoft attributed the axios compromise to "Sapphire Sleet," and said that Sapphire Sleet overlaps with activity other vendors track under names including UNC1069, STARDUST CHOLLIMA, BlueNoroff, Alluring Pisces, CageyChameleon, and CryptoCore.
Amazon links the axios compromise to the same group it ties to the earlier and later packages, but among the sources reviewed by The Hacker News, Amazon remains the sole attribution source for the debug, chalk and typo-crypto compromises. The axios attributions appeared within two days of that compromise; the other two incidents were attributed ten and sixteen months after the events.
What this means for npm maintainers, registry operators, and enterprise security teams
- Open-source maintainers and end users: The debug and chalk incidents underline that browser-side interceptors can rewrite transaction data without leaving on-disk persistence — Aikido and Wiz documented a browser-side interceptor that hooked fetch, XMLHttpRequest and wallet APIs to rewrite transaction addresses before a user signed.
- Registry operators and npm: npm shipped v12 on July 8 with dependency lifecycle scripts off by default, removing the default post-install path axios used; on July 28 npm began scanning newly published packages for malware before they become installable. Those changes affect some attack paths but do not eliminate social-engineering of maintainers or pre-existing malicious publishes.
- Enterprise security teams and procurement: Multiple vendors (Amazon, Google, Microsoft) are applying different analytic labels and techniques; enterprises should note that independent vendor attributions appeared quickly in the axios case, while the debug/chalk and typo-crypto linkages rested on a later Amazon assessment and on shared tradecraft indicators.
The public record now stitches together three campaigns across a year of activity using overlapping technical details and vendor analyses, but it also leaves concrete artifacts to reconcile — a published typo-crypto package that remains installable, a core.js file whose named trigger and XOR key match Amazon's description but whose listed hash does not appear in the tarball, and Amazon as the sole attribution source for two of the three campaigns. The Hacker News has reached out to Amazon and to Aikido for additional detail and said it will update the story with any response.
Source: The Hacker News — Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleet
