Amazon Names the Group Behind Four NPM Attacks
Amazon Threat Intelligence published findings on July 29 connecting four separate NPM package compromises to one DPRK-linked actor. These findings come from Amazon's own published analysis; no independent confirmation is available at this time. The security community tracks this group as SAPPHIRE SLEET, also known as STARDUST CHOLLIMA, BlueNoroff, CageyChameleon, and Alluring Pisces.
The four packages are axios, debug, chalk, and typo-crypto. The axios compromise had been publicly attributed to this actor before. The links to typo-crypto, debug, and chalk had not been established until this disclosure.
Axios sees more than 100 million weekly downloads. As reported by Wiz Research and cited by Amazon, roughly one in ten cloud environments were affected by the debug and chalk event within a two-hour window. According to Amazon, any organization that automatically pulled the latest version of these packages received the compromised update.
How the Attacker Got In
The method was consistent across all four incidents. The actor gained access by socially engineering a trusted maintainer, then published an update containing malicious code. Post-install hooks ran the malicious scripts automatically at install time.
Amazon identified shared tactics across campaigns: trojanized packages, post-install hooks, and code reuse. Based on analysis of command-and-control indicators and those shared tactics, Amazon assesses with medium confidence that all four campaigns belong to SAPPHIRE SLEET.
Amazon frames the targeting logic plainly. Compromising a small number of highly popular packages gives the group potential access to thousands of downstream environments at once. That is more efficient than targeting organizations individually.
The March 2025 Campaign Was a Dry Run
The typo-crypto compromise in March 2025 came first. Amazon assesses that campaign as small scale and likely a testing ground for the larger operations that followed in late 2025 and 2026.
The malicious file, core.js, triggers when it receives a hash input beginning with 0098273. When triggered, it downloads a second-stage payload from a hardcoded C2 server, then executes the payload based on the victim's operating system. Behavior is tailored for Windows, macOS, or Linux.
The malware uses multi-layer obfuscation combining base64 encoding with an XOR cipher. Amazon Inspector reported it to the Open Source Vulnerabilities database, where it is now tracked as MAL-2026-3400.
Published indicators of compromise include the [[S1|domain npmjs[.]store, IP address 216[.]74[.]123[.]126]], SHA256 hash 24604384b0e748ada07923630b3d037489e696284a98c4409fb9b6763565571f for the typo-crypto package, and SHA256 hash 2014d09c7ded74d89c885b5f11693865224116f1b25df9330e61fe528f419d73 for the trojanized core.js file.
A Split-Package Technique That Hides at Rest
Amazon Inspector has observed attackers splitting malicious logic across several ordinary-looking packages. One package stores an encrypted blob disguised as configuration. A second ships the decryption logic. A third, often published later, fetches and executes the payload.
Each package looks benign on its own. The threat only assembles at runtime.
What Application Teams Should Check Now
The delivery path depended on automatic updates. Teams that pull the latest package version on every build would have received the compromised update the moment it was published.
Three actions follow directly from Amazon's findings.
Verify your package versions. Check axios, debug, chalk, and typo-crypto against the indicators above. Look for the domain npmjs[.]store or the IP 216[.]74[.]123[.]126 in outbound traffic from build and runtime environments.
Check for post-install hooks. Identify which packages in your dependency tree execute scripts at install time. Confirm whether your build environment runs those hooks.
Review automatic update policies. If your pipeline pulls the latest version on every build, it had no protection against this method. The announcement does not state that any AWS service was compromised.