Amazon has tied the September 2025 hijack of the npm packages debug and chalk to North Korea. For ten months, the incident sat in the public record as crypto theft: a maintainer phished through a lookalike npm domain and a wallet-draining script pushed into at least 18 packages carrying more than 2 billion weekly downloads between them.
The original Aikido and Wiz reports did not attribute the incident to North Korea. In research published July 29, Amazon Threat Intelligence assesses with medium confidence that the group behind the March 2026 axios compromise was behind it.
The same group planted a trojanized file in a small package called typo-crypto in March 2025, according to Amazon, a full year before it reached axios. Analysts found it while chasing a domain registered in 2025 that surfaced during the axios investigation.
Downloads were low, but the tradecraft "aligns with what we later observed in attacks on more popular packages," Amazon wrote, and the company reads the package as a test run. Amazon's attribution spans four named packages across three campaigns in twelve months. All three, it says, began the same way: socially engineer a trusted maintainer, then publish an update.
Amazon reported no new compromise. The response scope for debug and chalk, browser bundles and caches, still matched the published mechanism. Only the attribution moved.
The evidence Amazon published is thinner than the claim. Its post cites shared tradecraft across the campaigns, trojanized packages, post-install hooks and code reuse, plus overlapping command-and-control indicators, but does not say which evidence ties which incident.
That gap matters most for debug and chalk, where Aikido and Wiz documented a browser-side interceptor that hooked fetch, XMLHttpRequest and wallet APIs to rewrite transaction addresses before a user signed. It left no persistence on the machine. Unlike the axios payload, this code did not depend on an npm post-install hook. Neither did typo-crypto, which waited for a trigger instead.
Google independently attributed axios to UNC1069, citing the WAVESHAPER.V2 backdoor and an AstrillVPN node the group had used before. Microsoft attributed the same compromise to Sapphire Sleet, which it says overlaps with activity other vendors track as UNC1069, STARDUST CHOLLIMA, BlueNoroff, Alluring Pisces, CageyChameleon, and CryptoCore.
The naming gap is resolved; Amazon's evidence gap is not. Among the sources reviewed here, no other vendor's published research names an actor for the debug, chalk and typo-crypto compromises. The axios attributions landed within two days of the compromise. The other two were attributed ten and sixteen months after the fact.
Amazon reads the pattern as financially motivated. Socket told The Hacker News at the time that the September wallets had netted about $600.
The malicious file Amazon describes, core.js, posed as the legitimate core-js package inside the repository. It triggered on a hash input beginning 0098273 and pulled an operating-system-specific second stage from a hardcoded C2, obfuscated with base64 over an XOR cipher keyed to 01042025. The network indicators are npmjs[.]store and 216[.]74[.]123[.]126.
Amazon's post cites the OSV record without naming a version. The Hacker News checked it: MAL-2026-3400 identifies typo-crypto@4.3.0, credits Amazon Inspector, and was published on May 8, nearly three months before the attribution.
The Hacker News checked the registry on July 30, 2026. typo-crypto@4.3.0 is still published and still installable. It declares no install script, so pulling it down does not on its own run anything. The tarball npm serves matches the registry's own integrity hashes.
The registry lists one version, created and published 204 milliseconds apart on March 31, 2025. The publishing account does not match the developer named in the package's author field. Its description and keywords are copied from crypto-js, at a version one release ahead of crypto-js's own latest, 4.2.0. crypto-js is a different project from the core-js the file impersonated.
That record does not fit a maintainer compromise followed by a malicious update, which is how Amazon characterizes all three campaigns. It fits a package built to impersonate crypto-js from the first publish. The record cannot show how the account was obtained, only that there was no earlier version to update.
The file matches the post in one respect: core.js contains both the trigger value and the XOR key Amazon names. The hashes do not match. Amazon lists the SHA256 of core.js as the package hash, and its stated core.js hash appears in no file in the tarball. Either a mislabeled indicator or a hash from a different copy would account for it. Amazon's post does not say which.
Aikido, which detected the September 2025 compromise, disputes that Amazon is the only source for the link. The company told The Hacker News it has tied that attack and the axios and Mastra compromises to North Korea for some time, in blog posts, conference talks and podcasts, and that the connection is common knowledge in the supply chain community. It called the finding "old news."
Asked what connected the incidents, Aikido cited command-and-control overlap between the axios and Mastra attacks. It described the debug and chalk compromise as "classic DPRK" in method and the link as "relatively clear," and said it did not analyze typo-crypto, having begun scanning npm later in March 2025. The company also confirmed the mechanism split: the debug and chalk attack used no lifecycle or install scripts, and the axios and Mastra attacks did.
The Hacker News has reached out to Amazon for detail on which evidence links the September 2025 compromise, and will update this story with any response.
npm shipped v12 on July 8 with dependency lifecycle scripts off by default, removing the default post-install path axios used. It does not close the maintainer-compromise path behind debug, chalk and axios. Reviewing the release, Sarah Gooding, writing for Socket, noted that "neither install-script blocking nor OIDC closes that entry point."
On July 28, npm began scanning newly published packages for malware before they become installable. The scan applies to new publishes, not to packages already on the registry.
