Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedhigh

Amazon links Debug, Chalk NPM supply-chain attacks to North Korean hackers

Amazon attributed multiple high-profile npm supply chain attacks targeting the Debug and Chalk packages to North Korean threat actors. The incidents involved compromised packages in the npm ecosystem with significant downstream impact.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Multiple high-profile npm packages (Debug, Chalk) with widespread downstream dependencies
Ecosystems
npm
Attack vectors
Compromised packageMalicious maintainer
Threat actor
Lazarus Group
Affected entities
  • debugnpm package
  • chalknpm package

Amazon has linked multiple high-profile open-source software supply chain attacks targeting the Node Package Manager (npm) ecosystem to North Korean hackers. The attacks specifically targeted the Debug and Chalk npm packages, which are widely used dependencies in the JavaScript ecosystem.\n\nThese packages have extensive downstream usage, meaning the compromise could have affected numerous projects and applications that depend on them. The attribution to North Korean threat actors represents a significant finding regarding the geopolitical dimensions of supply chain security threats.\n\nThe incidents demonstrate the continued targeting of popular open-source packages by state-sponsored actors seeking to compromise software supply chains at scale.

Indicators of compromise

Packages
  • debug
  • chalk

Remediation

  • Review and audit all versions of Debug and Chalk packages used in your projects
  • Update to patched versions of affected packages
  • Implement package integrity verification and signed package validation
  • Monitor npm package updates and security advisories for these and related packages
  • Consider using npm audit and dependency scanning tools to identify compromised versions
  • Implement supply chain security controls including package pinning and lock file verification

Sources

  1. Amazon links Debug, Chalk NPM supply-chain attacks to North Korean hackers · BleepingComputer

Cite this entry

"Amazon links Debug, Chalk NPM supply-chain attacks to North Korean hackers." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 30, 2026; last updated July 30, 2026. https://supplychainattack.org/incident/amazon-links-debug-chalk-npm-supply-chain-attacks-to-north-korean-hackers-15hi2d

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in xerohub-discord-voice-v3 (npm)

    The npm package xerohub-discord-voice-v3 contained malicious code that exfiltrated Discord user authentication tokens to a hardcoded webhook URL controlled by the package author. The startVoiceJoiner() function unconditionally sent raw tokens, usernames, guild IDs, and voice channel IDs to discord.com/api/webhooks/1528726419046404196 before executing any legitimate voice functionality.

    npmCompromised packageMalicious maintainer
  2. activecritical

    Malicious code in @cap-js/openapi (npm)

    The npm package @cap-js/openapi was compromised and found to contain malicious code. The package steals credentials and propagates them to other packages it has access to, with persistence mechanisms. This is attributed to the "Mini Shai-Hulud is back" worm campaign by the TeamPCP threat actor.

    Mini Shai HuludTeamPCPnpmCompromised packageMalicious maintainer
  3. containedhigh

    Microsoft links Mastra AI supply chain attack to North Korean hackers

    Microsoft attributed a Mastra AI supply chain attack that compromised over 140 npm packages to North Korean hacking group Sapphire Sleet (BlueNoroff). The attack targeted the npm ecosystem and AI development infrastructure.

    UNC1069npmAI agents & skillsCompromised packageMalicious maintainer
  4. activecritical

    Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat

    On June 17, 2026, an attacker compromised the @mastra npm organization and injected easy-day-js, a typosquat of the popular dayjs library, as a dependency across 140+ packages. The malicious package contained an obfuscated postinstall dropper that downloaded and executed a second-stage payload from attacker-controlled servers before self-deleting. The affected packages had a combined weekly download count exceeding 1.1 million.

    npmCompromised packageTyposquattingMalicious maintainer