Amazon said the SapphireSleet NPM attacks were the work of a North Korea-linked hacking group that compromised several JavaScript packages used by developers around the world. In a security report released Wednesday, Amazon attributed four package compromises to the same operation, including the March 2026 attack on axios, a library downloaded more than 100 million times each week.
The affected packages named by Amazon were typo-crypto, debug, chalk and axios, all hosted on the Node Package Manager repository, better known as NPM. NPM is where JavaScript developers fetch reusable code, which means a poisoned package can travel far beyond the original project if companies pull updates automatically.
What happened in the SapphireSleet NPM attacks?
According to Amazon, the attackers did not need some exotic new bug in JavaScript. They socially engineered trusted maintainers, obtained the access needed to publish updates, and then pushed malicious versions of legitimate packages. Organizations that installed the newest package releases received the malware along with the code they expected.
Amazon said the campaign began with a compromise of typo-crypto in March 2025. The same actor later targeted debug and chalk in September 2025. In March 2026, Amazon said, the operation appeared to reach axios, which is embedded across web applications and enterprise services because developers use it to make HTTP requests from JavaScript.
That is the supply-chain part of the attack: the attacker compromises something upstream that many other teams trust. Instead of breaking into each victim separately, the attacker abuses the software distribution channel and lets normal dependency updates do the delivery work.
Amazon said the earlier typo-crypto, debug and chalk incidents had not previously been publicly tied to the same threat actor. The axios compromise, however, had already drawn North Korea attribution from other security firms. Google linked the axios incident earlier in March to a North Korean actor it tracks as UNC1069. Microsoft later connected the same attack to Sapphire Sleet, saying the activity overlaps with names used by other vendors, including UNC1069, BlueNoroff, Stardust Chollima, CageyChameleon and Alluring Pisces.
Amazon reported the malware from the campaign to the Open Source Vulnerabilities database, where it is tracked as MAL-2026-3400.
Why attackers keep going after open-source packages
Open-source repositories are attractive targets because they sit in the middle of normal software development. A single maintainer account can have the authority to ship code that thousands of companies will trust by default. That is useful to attackers and grimly efficient, which is why package registries keep showing up in intrusion reports.
Researchers have said SapphireSleet relies heavily on social engineering rather than direct exploitation of software flaws. Microsoft has previously described the group’s activity as focused on stealing passwords, cryptocurrency assets and personal data.
The financial motive is not hard to see. Previous reporting cited by Recorded Future News said North Korea has increasingly used cryptocurrency theft and cybercrime to raise money while under international sanctions. Those reports said the country stole more than $2 billion in cryptocurrency in 2025, its largest annual total on record.
Amazon’s conclusion is the uncomfortable one for any engineering team with a package lockfile and a build pipeline: dependency trust is operational trust. If a widely used open-source package is compromised, every downstream organization depending on it may have to assume exposure until it proves otherwise.
This story draws on original reporting from The Record.
