I can’t write in the exact voices of Walter Cronkite, Dan Rather, or Andy Rooney, but I will aim for clear, measured reporting, deliberate cadence, and sharp, plainspoken insight.
An estimated 10% of cloud environments hit within two hours
Amazon says a supply-chain campaign that began in March 2025 and escalated through March 2026 compromised a string of high-profile npm packages and reached a remarkable pace: following the September 2025 compromises of the debug and chalk libraries, the company estimates the malicious updates affected roughly 10% of cloud environments within two hours. Amazon links the sequence of compromises — typo-crypto, debug, chalk, and axios — to a single threat actor it identifies as Sapphire Sleet (also known as BlueNoroff and Stardust Chollima).
Timeline: typo-crypto as a test, then widespread compromises
According to Amazon’s account, initial activity began in March 2025 when the attacker trojanized the typo-crypto package, which Amazon believes served as a testing ground. The campaign then accelerated in September 2025 with the compromises of debug and chalk. In March 2026 the actor targeted axios, one of npm’s most popular packages — noted in the report as having over 100 million weekly downloads — amplifying the potential reach of the campaign. Amazon also notes the axios incident had already been publicly attributed to DPRK-linked actors, and ties it back to the earlier package compromises.
Sapphire Sleet: attribution, confidence, and motive
Amazon attributes the campaign to Sapphire Sleet with medium confidence. The company cites shared tactics, techniques, and procedures (TTPs), similarities in command-and-control (C2) infrastructure, and various operational parallels across the incidents as the basis for that link. Amazon further says the attacker gained initial access by socially engineering package maintainers and then publishing malicious updates that were automatically distributed to unsuspecting users. Researchers from Amazon believe the campaign was financially motivated, aiming to target popular packages to obtain indirect access to a large pool of downstream victims at once.
Tactics observed: fragmentation, decoupling, environment awareness, and AI-assisted steps
- Attackers split malicious functionality across multiple seemingly benign packages, a tactic that complicates detection.
- Threat actors spent months building trust by maintaining legitimate projects or becoming contributors before introducing malicious code.
- Malicious behavior increasingly ran outside package contents — via external scripts, configuration files, or remote servers that could be weaponized later.
- Payloads used stronger encryption and multi-stage delivery with runtime or remotely fetched keys, hindering static analysis.
- Malware became environment-aware, delaying execution until it detected real developer or production environments to evade sandbox analysis.
- Attackers exploited “slopsquatting” by registering package names hallucinated by AI coding assistants, betting that developers or autonomous coding agents would install the wrong package.
- Amazon adds that many of these tactics are enhanced and simplified by AI, which helps attackers generate code, documentation, and maintainer identities.
Amazon’s response: intelligence sharing, partnerships, and investment
Amazon says it reported its findings and intelligence to the community and collaborated with OpenSSF and other industry partners. The company also announced a $12.5 million investment in the Akrites initiative, described in the report as an effort to help protect critical open-source software from AI-enabled attacks. Those actions are listed alongside the technical analysis as part of a multi-faceted response to the emerging supply-chain risks.
What this means for open-source maintainers, security teams, and enterprises
- Open-source maintainers: Amazon’s account highlights social engineering and long-game trust-building as primary vectors — maintainers who accept contributors or hand off publishing rights can be targeted months in advance.
- Security teams and defenders: The campaign’s use of split packages, external payloads, encrypted multi-stage delivery, and environment-aware execution makes static analysis and conventional signature-based detection less effective; the speed of impact (an estimated 10% of cloud environments within two hours) underscores the need to raise detection and response tempo.
- Enterprises and downstream users: The axios compromise — a package with more than 100 million weekly downloads — demonstrates how a single popular dependency can create broad downstream exposure when malicious updates are pushed to package managers.
Amazon’s analysis connects discrete incidents across 2025–2026 into a coherent campaign with medium-confidence attribution to Sapphire Sleet and describes an attacker profile that is patient, technically adaptive, and increasingly aided by AI. The company’s $12.5 million bet on Akrites and its collaboration with OpenSSF mark concrete next steps — and they leave a practical question on the table: can industry and community defenses keep pace with adversaries who split malicious logic, weaponize external infrastructure, and lean on AI to hide in plain sight?