bleeping-computer Jul 30, 2026 · Crawled Jul 30, 2026

Amazon links Debug, Chalk NPM supply-chain attacks to North Korean hackers

4 IoCs 2 Actors

AI Summary

Amazon has linked multiple npm supply-chain attacks to the North Korean threat actor Sapphire Sleet (also known as BlueNoroff and Stardust Chollima) with medium confidence. The attacks began in March 2025 with the compromise of the typo-crypto package, followed by the trojanization of widely used packages debug and chalk in September 2025, impacting an estimated 10% of cloud environments within two hours. In March 2026, the axios library—used by over 100 million developers weekly—was targeted, with malicious updates distributed after attackers socially engineered maintainers to gain access. The campaign used sophisticated tactics including delayed execution in real environments, multi-stage payloads, and 'slopsquatting' of AI-hallucinated package names to expand reach.

AI-extracted · verify before operational use

Extracted Entities 2 found

Threat Actor Lazarus Group → Threat Actor STARDUST CHOLLIMA →

Indicators of Compromise 4 extracted

Type	Value	Detail
Package	typo-crypto	Details →
Package	debug	Details →
Package	chalk	Details →
Package	axios	Details →

MITRE ATT&CK TTPs 15 techniques

T1027 Obfuscated Files or Information · Defense Evasion T1029 Scheduled Transfer · Exfiltration T1059 Command and Scripting Interpreter · Execution T1059.001 PowerShell · Execution T1071.001 Web Protocols · Command And Control T1085 T1085 T1105 Ingress Tool Transfer · Command And Control T1134 Access Token Manipulation · Defense Evasion T1195.002 Compromise Software Supply Chain · Initial Access T1204.002 Malicious File · Execution T1218.011 Rundll32 · Defense Evasion T1557 Adversary-in-the-Middle · Credential Access T1566 Phishing · Initial Access T1566.001 Spearphishing Attachment · Initial Access T1610 Deploy Container · Defense Evasion