Amazon Names the Group Behind a String of NPM Attacks
Amazon published threat intelligence findings on July 29 connecting four separate compromises of popular Node Package Manager (NPM) libraries to one DPRK-linked threat actor. The group is tracked by the security community as SAPPHIRE SLEET, and also known as STARDUST CHOLLIMA, BlueNoroff, CageyChameleon, and Alluring Pisces.
The four affected packages are axios, debug, chalk, and typo-crypto. According to Amazon, the axios compromise was previously attributed publicly to this threat actor, but the links to debug, chalk, and typo-crypto had not been established before this disclosure.
Axios sees more than 100 million weekly downloads. Wiz Research found that roughly one in ten cloud environments were affected by the debug and chalk event within a two-hour window, reflecting the reach those packages carry. Any organization that automatically pulled the latest package version received the compromised update, according to Amazon's post.
How the Attacks Were Carried Out
The operational method was consistent across all four incidents. Attackers socially engineered a trusted maintainer, gained publish access, then pushed an update containing malicious code. The compromise did not require breaking into a registry or exploiting a software flaw. It exploited human trust.
Once installed, the packages used post-install hooks to execute malicious scripts automatically. These are scripts that run at install time when a package is installed. Amazon identified shared tactics across campaigns, including trojanized packages, post-install hooks, and code reuse.
Metrotechs analysis: build pipelines that do not restrict or audit hook execution are structurally exposed to this delivery method, regardless of which package is targeted next.
The typo-crypto compromise in March 2025 appears to have been an early test. Amazon assessed it as a small-scale campaign that likely served as a testing ground for the later, higher-impact operations. That package's malware uses multi-layer obfuscation, combining base64 encoding with an XOR cipher. A hardcoded command-and-control server delivered a second-stage payload tailored for Windows, macOS, or Linux.
The malware is now tracked as MAL-2026-3400 in the Open Source Vulnerabilities database.
Published indicators of compromise include the [[S1|domain npmjs[.]store, IP address 216[.]74[.]123[.]126]], and specific SHA256 hashes for the typo-crypto package and its trojanized core.js file.
The Scale Risk Is the Point
Amazon's assessment frames the targeting logic directly. Compromising a small number of widely used packages gives the group potential access to thousands of downstream environments simultaneously. That is more efficient than targeting individual organizations, according to Amazon.
Amazon also describes an emerging tradecraft shift. Attackers are splitting malicious logic across several ordinary-looking packages. One package carries an encrypted payload. Another carries the decryption logic. A third fetches and executes it. Each package may pass a surface-level review. The threat only assembles at runtime, according to Amazon's analysis.
The announcement does not state that any AWS service was compromised. It does not confirm whether the malicious packages remain available or have been fully removed from the NPM registry. Those details are absent from the source.
What Application Teams and Platform Owners Should Do
This is a dependency pipeline problem, not just a patching problem. Automatic update policies are the delivery mechanism the attacker relied on. Metrotechs analysis: teams that pull dependencies without version pinning or integrity checks are structurally exposed to the same method.
Three bounded actions follow from the evidence:
Check your axios, debug, chalk, and typo-crypto versions. Compare them against Amazon's published indicators of compromise. Look for the domain npmjs[.]store or the IP 216[.]74[.]123[.]126 in outbound traffic logs from build and runtime environments.
Audit post-install hook exposure. Review which packages in your dependency tree execute scripts at install time. Determine whether your CI/CD environment runs those hooks with elevated access to secrets, credentials, or cloud metadata.
Review automatic update policies. If your pipeline pulls the latest version of a package on every build, it would have received the compromised update the moment it was published. Version pinning and lockfile enforcement limit that exposure. The tradeoff is manual update overhead, which teams must weigh against the demonstrated risk.
Amazon states it is sharing this research to help the open source community and security teams identify and address these events. Its assessment also notes that the volume and sophistication of software supply chain attacks are increasing, driven in large part by DPRK-linked threat actors and cybercriminal groups.