State-Sponsored Cyberattack: Amazon Attributes 2025 npm Hijacks to North Korea

New intelligence from Amazon has linked a significant supply chain compromise involving the popular npm packages 'debug' and 'chalk' in September 2025 directly to North Korea's state-sponsored cyber group, Sapphire Sleet. This attribution dramatically shifts the understanding of an incident that for ten months was publicly considered a relatively straightforward case of cryptocurrency theft.

The initial reports surrounding the September 2025 compromise indicated a sophisticated phishing operation. A maintainer responsible for the affected packages was reportedly targeted through a meticulously crafted lookalike npm domain, designed to steal credentials. Once access was gained, a malicious script was subsequently injected into at least 18 different npm packages, designed to drain cryptocurrency wallets.

Amazon's findings elevate the incident from common cybercrime to a matter of national security, suggesting a more strategic and hostile intent behind the attack. Sapphire Sleet, a group widely associated with the Democratic People's Republic of Korea, is known for its advanced persistent threat activities, often targeting critical infrastructure and financial institutions for espionage or illicit funding.

The npm registry serves as a crucial backbone for modern web development, hosting millions of open-source software modules. A compromise of widely used packages like 'debug' and 'chalk' presents a substantial threat, as malicious code can propagate rapidly across countless applications and systems that depend on them. Such supply chain attacks are particularly potent because they exploit the trust developers place in third-party components.

The methodology employed, leveraging a human element through phishing combined with the widespread distribution capability of the npm ecosystem, underscores a growing vulnerability. It highlights how even highly technical environments can be breached through social engineering tactics, leading to far-reaching consequences across the software landscape.

This new attribution from Amazon will likely prompt a re-evaluation of the incident's impact and potential long-term implications for software supply chain security. It reinforces the need for enhanced vigilance, not just against opportunistic cybercriminals, but also against sophisticated state-backed actors who view open-source infrastructure as a viable vector for their operations.

The revelation underscores the ongoing challenge faced by the cybersecurity community in identifying and counteracting state-sponsored threats, particularly when they mask their activities behind what initially appears to be financially motivated crime. As investigations continue, the industry will undoubtedly be scrutinizing defenses against similar future attacks from advanced persistent threat groups like Sapphire Sleet.