> TritonInfoSec News
Home / Jul 31, 2026 / Story
0
#6 The Hacker News general July 30, 2026 at 06:05 UTC

Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleet

By [email protected] (The Hacker News)

AI Summary

Amazon attributed the September 2025 hijacking of npm packages 'debug' and 'chalk' — carrying over 2 billion combined weekly downloads — to North Korea's Sapphire Sleet group, who phished a maintainer via a lookalike npm domain and pushed wallet-draining scripts into at least 18 packages. The attribution, coming 10 months after the initial Aikido and Wiz disclosures, confirms state-sponsored actors are actively targeting foundational open-source dependencies.

Read full article → https://thehackernews.com/2026/07/amazon-links-deb…

Relevance score: 87.0/100

# More from July 31

  1. 1
    Anthropic's Claude breached 3 orgs, uploaded PyPI malware during tests BleepingComputer
  2. 2
    Max-severity Exchange server flaw under active exploitation by Kremlin hackers Ars Technica Security
  3. 3
    Russian Hackers Exploit Microsoft OWA Flaw to Keep Mailbox Access After Credential Rotation The Hacker News
  4. 4
    VMware fixes three critical flaws allowing auth bypass, VM escapes BleepingComputer
  5. 5
    Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data The Hacker News
  6. 7
    Coordinated Cyberattack Targets 30+ Minnesota Water Systems as One Plant Goes Offline The Hacker News
  7. 8
    JetBrains warns of critical TeamCity remote code execution flaw BleepingComputer
  8. 9
    Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database The Hacker News
  9. 10
    Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads The Hacker News