Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleet

The Hacker News 30 July 2026, 09:05 EEST Domains

Amazon has tied the September 2025 hijack of the npm packages debug and chalk to North Korea. For ten months, the incident sat in the public record as crypto theft: a maintainer phished through a lookalike npm domain and a wallet-draining script pushed into at least 18 packages carrying more than 2 billion weekly downloads between them. The original Aikido and Wiz reports did not attribute…

Read the full story on The Hacker News https://thehackernews.com/2026/07/amazon-links-debug-and-chalk-npm-hijack.html

An expired domain or a forgotten certificate takes a site down just as effectively as an attack. At CrockyHost hosting renewals and SSL are handled for you.

Keep reading

Public PoC Released for Exploited Check Point SmartConsole Authentication Bypass The Hacker News
Flying Eagle Android RAT Traces Found on 170 Servers as Source Code Circulates The Hacker News
CubePilot drone software dev hit by DNS hijacking to intercept traffic BleepingComputer
BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery The Hacker News