hacker-news Jul 30, 2026 · Crawled Jul 30, 2026

Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleet

4 IoCs 2 Actors

AI Summary

Amazon Threat Intelligence attributes the September 2025 compromise of the npm packages debug and chalk to the North Korean threat actor Sapphire Sleet, also linked to prior attacks on axios and typo-crypto. The attacks began with social engineering of maintainers, followed by malicious updates containing trojanized code. The debug and chalk incident involved a browser-side interceptor that hijacked cryptocurrency transactions by rewriting wallet addresses, while other campaigns used post-install hooks and command-and-control infrastructure. Amazon ties the campaigns together through shared tradecraft, code reuse, and overlapping C2 indicators, though some technical discrepancies exist in the evidence.

AI-extracted · verify before operational use

Extracted Entities 2 found

Threat Actor Lazarus Group → Threat Actor UNC1069 →

Indicators of Compromise 4 extracted

Type	Value	Detail
Domain	npmjs[.]store	Details →
IP	216[.]74[.]123[.]126	Details →
Filename	core.js	Details →
SHA-256	0098273	Details →

MITRE ATT&CK TTPs 10 techniques

T1027 Obfuscated Files or Information · Defense Evasion T1059.001 PowerShell · Execution T1071.001 Web Protocols · Command And Control T1085 T1085 T1134 Access Token Manipulation · Defense Evasion T1204.002 Malicious File · Execution T1218.011 Rundll32 · Defense Evasion T1557 Adversary-in-the-Middle · Credential Access T1566 Phishing · Initial Access T1566.001 Spearphishing Attachment · Initial Access