Amazon attributes axios, debug, chalk NPM attacks to DPRK’s Sapphire Sleet

Amazon Threat Intelligence assessed with medium confidence that supply chain attacks on the axios, debug, chalk and typo-crypto NPM packages over the past two years were conducted by the North Korean threat actor known as Sapphire Sleet, according to an AWS security blog published Wednesday.

Sapphire Sleet, also known as BlueNoroff, Stardust Chollima, CageyChameleon and Alluring Pisces, is a threat group sponsored by the Democratic People’s Republic of Korea (DPRK) that is known to spread cryptocurrency-stealing malware for financial gain. The group has also been involved in North Korea’s remote IT worker schemes to bring funding back to the regime.

The axios, debug and chalk, and typo-crypto NPM packages were compromised in three separate campaigns that have now been linked together by Amazon researchers due to overlapping tactics, techniques and procedures (TTPs), command-and-control (C2) artifacts, and reused code, according to the blog post authored by Amazon Integrated Security CISO CJ Moses.

The typo-crypto package, a lesser-known package compromised with a malicious commit in March 2025, was identified by Amazon Threat Intelligence during its investigation into the TTPs and indicators involved in the attack on the axios package, which was compromised in March 2026 and had about 100 million weekly downloads at the time of the attack.

Amazon found a connection between the axios attacker and a domain that was involved in the typo-crypto compromise, where a malicious file disguised as the legitimate core-js package (core.js) executed upon receiving a hash input, downloading a second-stage payload from a remote server tailored to the victim’s operating system (Windows, macOS or Linux).

“Based on the limited number of observed downloads, Amazon Threat Intelligence assesses that this campaign was small scale and likely served as a testing ground for the more visible supply chain operations that followed in late 2025 and 2026,” Moses wrote. “The group appears to have been refining supply chain techniques more than a year before the larger campaigns that drew public attention.”

The axios attack had previously been attributed to the North Korean cluster UNC1069, which is known to overlap with Sapphire Sleet/Bluenoroff, according to a Google Cloud report on its activity. Amazon further linked this actor to the chalk and debug attacks through its analysis of C2 indicators and TTPs, which included the use of trojanized NPM packages and post-install hooks as well as reused code. These attacks had not previously been attributed to the same DPRK-sponsored threat actor as the axios attack, according to Amazon.

“Defenders should not concern themselves too much with who is performing an attack and more with knowing likely techniques of a specific attacker. Distinguishing between one group and another can be helpful for defense teams, knowing whether it is North Korea or Canada is less relevant,” said Cris Thomas, security advocate at Semgrep, in comments to SC Media. “As always, defenders should rely on defense in depth, if one defense doesn’t find them another one will. The goal isn’t to prevent successful attacks but to identify limit, block and correct attacks as soon as possible.”

Supply chain campaigns evolve with advanced evasion techniques, genAI use

Amazon’s blog post further describes how the tactics involved in NPM supply chain attacks have evolved over the last two years, with more long-term trust building, effective evasion techniques and the use of generative AI.

The researchers note how attackers in these campaigns often integrate themselves as trusted maintainers, making benign and useful changes to established projects before incorporating malicious payloads, as seen in the xz utils attack (which has not been attributed to the same threat actor).

Threat actors have also fragmented malicious workflows across several packages rather than deploying a single malicious package that could be more easily detected. For example, the attacker may add an encrypted payload to one package, the decryption logic in another package and a script to ultimately fetch and execute the package in a third, Amazon described.

Supply chain attackers are also improving their anti-analysis tactics through the use of encryption methods, such as AES-GCM, RC4 and XOR, rather than basic obfuscation such as base64, with decryption keys often retrieved from a remote server during execution, derived from runtime context or included as a license key rather than hardcoded.

Many malicious packages now include sandbox checks to avoid analysis, and many also retrieve malicious payloads from external servers or repositories during runtime rather than including malicious functions within the code itself. This allows the package to remain “clean” when scanned and reviewed, while malicious behavior can later be triggered by changes to the remote server or repository it connects to, Amazon explained.

“I don’t think this is really a problem that individual organizations can fix. Supply chain attacks need to be solved at the package manager level, anything else is just a stopgap,” noted Katie Paxton-Fear, staff security advocate at Semgrep, in an email to SC Media. “Npm v12 is bringing in changes to directly reduce supply chain attacks like the ones from North Korea, but I think every package manager needs to consider these threats from well resourced state sponsored attacks asap or they will find themselves next on the list of targets.”

AI can be used in supply chain attacks to generate new malware variants for each campaign, evading signature-based and pattern-based detection methods, Amazon noted. Additionally, a technique known as slopsquatting can allow attackers to leverage package names hallucinated by large language models (LLMs) by publishing packages under these names in the hopes that users will install them based on an LLM’s recommendation.

Lastly, Amazon noted that the increasing use of AI-based code security scanners may lead attackers to include malicious instructions within malware packages to trick the AI into returning a clean result or perform other adverse actions — a form of indirect prompt injection.  

Sapphire Sleet has previously been noted to use generative AI to help create false personas for its remote IT worker scams, and OpenAI previously reported disrupting accounts on its platform belonging to BlueNoroff and other DPRK-sponsored threat actors.