Sapphire Sleet (DPRK) Behind Axios, Debug npm Attacks

#cybersecurity #supplychainattack #malware #threatactor

Originally published on CyberNetSec.

Executive Summary

Amazon Threat Intelligence has formally attributed a series of significant software supply chain attacks targeting the npm ecosystem to Sapphire Sleet, a threat actor linked to the Democratic People's Republic of Korea (DPRK) and also tracked as BlueNoroff. The group is responsible for compromising extremely popular JavaScript libraries, including axios, debug, and chalk, by hijacking maintainer accounts. The attackers published malicious versions of these packages, designed to execute automatically upon installation, leading to widespread compromise. The campaign demonstrates increasing sophistication, with attackers using long-game social engineering tactics and evolving their tradecraft to evade detection. This activity poses a critical risk to organizations worldwide that rely on open-source software.

Threat Overview

The campaign represents a classic software supply chain attack, where attackers inject malicious code into a legitimate software component to compromise downstream users. The threat actor, Sapphire Sleet, used social engineering to gain credentials for the npm accounts of legitimate package maintainers. Once they had access, they published new, malicious patch versions of the libraries.

Key compromised packages and timeline:

typo-crypto: March 2025 (assessed as a test run)
debug and chalk: September 2025
axios: March 2026

The impact was massive due to the popularity of these packages. axios alone has over 100 million weekly downloads. The debug and chalk compromises are estimated to have affected approximately 10% of all cloud environments within just two hours. This highlights the speed and scale at which supply chain attacks can propagate.

Technical Analysis

The attackers' TTPs show a consistent and evolving methodology. Microsoft tracks a related sub-cluster as Midnight Blizzard (distinct from the Russia-linked group of the same name, this appears to be a naming collision in the source material, the activity is DPRK-linked), noting its use in the "CaptiveCrunch" campaign.

Attack Chain:

Reconnaissance & Resource Development: The group identifies popular packages and their maintainers. They engage in long-term social engineering to build trust or find an angle for compromise.
Initial Access: The primary vector is T1199 - Trusted Relationship or T1566 - Phishing to steal maintainer credentials, leading to T1078 - Valid Accounts.
Execution: The malicious code is executed via post-install scripts defined in the package.json file. This is a form of T1195.002 - Compromise Software Supply Chain.
Defense Evasion & Persistence: To evade detection, attackers split malicious logic across several seemingly benign packages, a technique related to T1027 - Obfuscated Files or Information. The malicious activity is often triggered by external scripts or remote endpoints, making static analysis of the package itself insufficient for detection.

The use of trojanized NPM packages is the central technique, falling under T1554 - Compromise Client Software Binary.

Impact Assessment

The potential impact of this campaign is critical. By compromising foundational libraries like axios and debug, Sapphire Sleet could have gained access to countless development environments, CI/CD pipelines, production servers, and cloud infrastructure. This access could be used for espionage, financial theft (a known motive for BlueNoroff), or to stage further, more disruptive attacks. The attack on 10% of cloud environments demonstrates a systemic risk to the entire software industry. Organizations that automatically update dependencies without verification are at extreme risk. The reputational damage to the npm ecosystem and the compromised projects is also significant.

IOCs — Directly from Articles

No specific file hashes, IP addresses, or domains were provided in the source articles.

Cyber Observables — Hunting Hints

Security teams may want to hunt for the following patterns to identify potential supply chain compromise:

Type	Value	Description	Context
`file_name`	`package-lock.json`	Review for unexpected version bumps or new, suspicious dependencies.	Version control history, file integrity monitoring.
`command_line_pattern`	`npm install` or `yarn install`	Monitor for network connections to unusual domains during dependency installation.	Process monitoring (Event ID 4688), EDR, network logs.
`file_path`	`node_modules/*/scripts/postinstall.js`	Scrutinize `post-install` scripts in dependencies for obfuscated code or network activity.	Static analysis, code review tools.
`network_traffic_pattern`	Outbound traffic from build servers	Baseline normal traffic from CI/CD runners and alert on connections to new or uncategorized domains.	Firewall logs, proxy logs, DNS logs.

Detection & Response

Detection:

Dependency Scanning: Use tools like npm audit or third-party Software Composition Analysis (SCA) scanners to identify known vulnerable package versions. This is a form of File Analysis (D3-FA).
Behavioral Analysis: In a sandboxed environment, monitor the behavior of CI/CD pipelines during dependency installation. Alert on unexpected file system modifications, process execution, or network connections.
Network Monitoring: Closely monitor outbound DNS queries and HTTP/S requests from build servers and developer workstations. Look for connections to domains not associated with legitimate package registries or corporate resources.

Response:

Isolate: Immediately isolate affected build servers or developer machines from the network.
Identify Scope: Determine which projects and systems have installed the malicious package versions by analyzing package-lock.json files and build logs.
Remediate: Remove the malicious packages, roll back to a known-good version, and assume that any secrets or credentials on the affected systems have been compromised. Rotate all keys, tokens, and passwords.

Mitigation

Immediate Actions:

Pin Dependencies: Use package-lock.json or yarn.lock to lock dependency versions. Avoid using version ranges (^ or ~) for critical dependencies to prevent automatic updates to potentially malicious versions.
Vet Dependencies: Before adding a new dependency, vet its maintainers, popularity, and history. Prioritize packages with strong security practices.
Restrict Build Environments: Run CI/CD jobs in ephemeral, isolated containers with no access to production secrets or sensitive networks.

Strategic Recommendations:

Implement SCA: Integrate Software Composition Analysis (SCA) tools into the CI/CD pipeline to automatically detect vulnerable or malicious dependencies before they reach production. This is a practical application of D3FEND's Software Update (D3-SU) checking.
Use a Private Registry: Consider using a private npm registry that acts as a proxy and cache. This allows for greater control and scanning of third-party packages before they are introduced into the development environment.