---
title: AWS Links npm Supply Chain Attacks to North Korean Hackers
description: AWS links npm attacks on axios, debug and chalk to North Korean group Sapphire Sleet with medium confidence. Attackers also exploit AI-named packages.
canonical_url: https://codekeeper.co/ticker/north-korean-group-targets-npm-libraries
---

# AWS Links npm Supply Chain Attacks to North Korean Hackers

AWS links npm attacks on axios, debug and chalk to North Korean group Sapphire Sleet with medium confidence. Attackers also exploit AI-named packages.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Aug 1, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnorth-korean-group-targets-npm-libraries%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnorth-korean-group-targets-npm-libraries%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnorth-korean-group-targets-npm-libraries%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnorth-korean-group-targets-npm-libraries%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnorth-korean-group-targets-npm-libraries%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnorth-korean-group-targets-npm-libraries%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

AWS assesses with medium confidence that a series of npm supply chain attacks — targeting popular libraries including axios, debug, chalk, and typo-crypto — was the work of a North Korean threat group known as Sapphire Sleet or BlueNoroff. The group socially engineered package maintainers, then pushed malicious updates that automatically executed on installation. Axios alone sees over 100 million weekly downloads, and according to Wiz Research the debug and chalk attacks hit roughly 1 in 10 cloud environments within just two hours. AWS CISO CJ Moses noted the typo-crypto compromise in March 2025 appears to have been a test run. Attackers are also now exploiting AI-hallucinated package names to expand their reach. Source: [Infosecurity Magazine](https://www.infosecurity-magazine.com/news/aws-north-korea-axios-npm-supply/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnorth-korean-group-targets-npm-libraries%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnorth-korean-group-targets-npm-libraries%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnorth-korean-group-targets-npm-libraries%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnorth-korean-group-targets-npm-libraries%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnorth-korean-group-targets-npm-libraries%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnorth-korean-group-targets-npm-libraries%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Hackers Steal 740,000 Pieces of Data from UK Education Department and Police Database Aug 11, 2026](https://codekeeper.co/ticker/exfilsquad-hacks-uk-databases-stealing-records)

[Data breaches Minnesota Supreme Court Hit by Third-Party Data Breach Sep 4, 2026](https://codekeeper.co/ticker/minnesota-courts-data-breach-thomson-reuters)

['RufRoot' Flaw Exposes AI Agent Platforms to Memory Poisoning — Even After Patching Aug 11, 2026](https://codekeeper.co/ticker/critical-ruflo-ai-vulnerability-patch)

[Cyberattacks CenterPoint Confirms Data Breach After Hacker Leaks Customer Records Sep 16, 2026](https://codekeeper.co/ticker/centerpoint-energy-data-breach-2023)