Amazon links Debug, Chalk NPM supply-chain attacks to North Korean hackers

North Korean threat actors from Sapphire Sleet successfully compromised widely-used npm packages—including debug, chalk, and axios—by targeting the human link in the software supply chain: the package maintainers themselves. By using social engineering tactics, the attackers bypassed traditional code-level security controls and injected malicious multi-stage payloads into packages downloaded hundreds of millions of times weekly. The use of AI-assisted code generation and environment-aware malware made detection significantly harder, allowing the campaign to persist and escalate over multiple years. This matters because a single compromised upstream package can silently propagate malicious code into thousands of downstream applications and cloud environments at scale. Organizations that blindly trust popular open-source packages without verification are exposed to nation-state level threats embedded directly in their development pipelines.