“Based on analysis of command-and-control (C2) indicators and TTPs, Amazon Threat Intelligence assesses with medium confidence that these campaigns are attributable to the DPRK-linked threat actor tracked as Saphire Sleet,” CJ Moses, CISO and VP of security engineering at Amazon, wrote in an AWS blog post on July 29.
Amazon Threat Intelligence attributes npm compromises to Saphire Sleet
AWS says a string of supply‑chain compromises that touched widely used npm libraries — including axios, debug, chalk and typo‑crypto — were carried out by the same group, referenced variously as Saphire Sleet, BlueNoroff and other monikers. Amazon Threat Intelligence drew the connection after analyzing tactics, techniques, and procedures (TTPs) associated with the axios compromise and identifying shared indicators across campaigns.
The playbook: social engineering, poisoned updates, wide downstream reach
The attacks followed a consistent playbook, AWS reported: the actor socially engineered package maintainers, then published legitimate‑looking software updates that included malicious code. Any organization that automatically pulled those versions therefore received compromised updates. AWS highlighted that the typo‑crypto compromise in March 2025 “was likely a test run for the campaigns that followed,” and that the later debug and chalk campaigns affected “around 10% of cloud environments … in a two‑hour window.”
AWS underscored the scale risk posed by axios specifically: axios is “one of the most popular JavaScript libraries around, with over 100 million weekly downloads,” making a small number of high‑profile compromises a fast and efficient way to reach thousands of downstream environments simultaneously.
AWS details shifting attacker tradecraft
CJ Moses summarized evolving attacker behaviors that complicated detection and response. Amazon Threat Intelligence identified shared TTPs including “trojanized NPM packages, use of post‑install hooks (scripts that run automatically when a package is installed), and code reuse.” AWS also listed trends the adversary employed:
- Splitting a single malicious workflow across several ordinary‑looking packages to make detection harder
- Behaving like “real maintainers” for weeks or months before publishing malicious updates
- Keeping package contents often benign and embedding malicious functionality in external scripts, configuration files and remote endpoints
- Sophisticated obfuscation such as “AES‑GCM encrypted blobs gated by passphrases, RC4‑style string arrays with per‑call keys, layered XOR over base64, and native loaders”
- Payloads designed to evade sandbox analysis
- Using slopsquatting techniques — registering package names hallucinated by AI coding tools to increase victim numbers
Cris Thomas and the debate over attribution versus defense
Not everyone agreed that attribution should be the central focus. Cris Thomas, security advocate at Semgrep, argued that “attribution is best left to governments and law enforcement.” He urged defenders to prioritize technical detection and layered protections over chasing the actor’s identity: “Defenders should not concern themselves too much with who is performing an attack and more with knowing likely techniques of a specific attacker. Distinguishing between one group and another can be helpful for defense teams, knowing whether it is North Korea or Canada is less relevant.”
Thomas added a practical posture for incident response teams: “As always defenders should rely on defense in depth, if one defense doesn't find them another one will. The goal isn't to prevent successful attacks but to identify, limit, block, and correct attacks as soon as possible.”
What this means for maintainers, defenders, and enterprises
Open‑source maintainers: The attacks underscore how social engineering of maintainers can enable broad compromise. Maintainers who see unusual collaborator requests, or who use automated publishing flows, are among the immediate points of risk described by AWS.
Security teams and defenders: AWS’s list of TTPs points to detection priorities — monitor post‑install hooks and remote endpoints invoked by packages, look for obfuscated payloads that unlock only after installation, and anticipate multi‑package workflows that mask a single malicious chain.
Affected enterprises and procurement leaders: The campaigns demonstrate the downstream reach of a compromised popular package. Organizations that automatically consume npm updates are particularly exposed; the two‑hour window impact on “around 10% of cloud environments” during the debug and chalk incidents illustrates how fast a compromise can propagate.
Amazon’s assessment and Semgrep’s rebuttal frame a clear operational tension: attribution may inform response at the strategic level, but the technical indicators and tradecraft AWS documents are the immediate tools defenders need. AWS has published a concrete set of TTPs and examples that security teams can hunt for; how quickly registries, maintainers and automated tooling adopt mitigations will determine whether a small set of future compromises can again produce thousand‑fold reach through popular packages.
Read the original AWS reporting: https://www.infosecurity-magazine.com/news/aws-north-korea-axios-npm-supply/
