Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleet

Amazon has attributed the hijacking of the npm packages debug and chalk to North Korea. The incident, which occurred in September 2025, involved a maintainer being phished through a lookalike npm domain, resulting in a wallet-draining script being pushed into at least 18 packages. These packages had a combined total of over 2 billion weekly downloads. The incident was initially reported as a crypto theft, but its attribution to North Korea has only now been made public by Amazon. The original reports from Aikido and Wiz did not include attribution for the incident. Amazon's findings provide new insight into the origins of the hijacking.