Amazon Links Debug and Chalk npm Hijack to North Korea's Sapphire Sleet

Amazon has attributed the September 2025 hijack of the widely-used npm packages debug and chalk to North Korea’s Sapphire Sleet group.

A maintainer was phished via a lookalike npm domain, and a wallet-draining script was pushed into at least 18 packages carrying more than 2 billion combined weekly downloads, per The Hacker News. The original Aikido and Wiz reports on the incident did not attribute it to a nation-state actor — this is the first public attribution to North Korea.