Amazon Attributes npm Hijacks of Debug and Chalk to North Korea

Amazon Threat Intelligence has linked the September 2025 compromise of popular npm packages debug and chalk to North Korean actors, citing shared tradecraft with other supply chain attacks.

Key Points:

• Amazon attributes the hijack of debug and chalk, which have over 2 billion weekly downloads, to the same group behind the March 2026 axios compromise.
• The attack involved a maintainer being phished via a lookalike npm domain, leading to the insertion of a wallet-draining script.
• Amazon also links the typo-crypto package to the group, viewing it as a test run for later, larger campaigns.
• Other vendors like Google and Microsoft have independently attributed the axios attack to North Korean groups, though Amazon's specific evidence for the earlier incidents remains under scrutiny.
• npm has recently implemented new security measures, including malware scanning for new packages and disabling lifecycle scripts by default.

Amazon Threat Intelligence has released new research attributing the September 2025 hijack of the widely used npm packages debug and chalk to North Korean state-sponsored actors. The compromise affected packages with a combined weekly download count exceeding 2 billion. The attack vector involved social engineering a trusted maintainer through a lookalike npm domain, allowing attackers to push a malicious update that intercepted browser-based cryptocurrency transactions. This incident is part of a broader pattern of supply chain attacks that Amazon links to the same group responsible for the March 2026 axios compromise and the typo-crypto package.

Learn More: The Hacker News

Want to stay updated on the latest cyber threats?

👉 [Subscribe to r/PwnHub](https://www.reddit.com/r/pwnhub)