npm Packages debug and chalk Hijacked by North Korea: Crypto Theft Confirmed
The npm packages debug and chalk were hijacked by North Korea's Sapphire Sleet, resulting in crypto theft. The maintainer was phished, and a wallet-draining script was pushed into at least 18 packages with over 2 billion weekly downloads.
What happened
Amazon Threat Intelligence has attributed the September 2025 hijack of the npm packages debug and chalk to North Korea's Sapphire Sleet. The incident involved a maintainer being phished through a lookalike npm domain, leading to the insertion of a wallet-draining script into at least 18 packages, which collectively have over 2 billion weekly downloads. Amazon's attribution is based on shared tradecraft, trojanized packages, and overlapping command-and-control indicators across multiple campaigns.
The attack began with the trojanization of the typo-crypto package in March 2025, which Amazon believes was a test run. This was followed by the compromise of the debug and chalk packages in September 2025, and later the axios package in March 2026. The debug package was affected in versions introduced from 3.0.0 to 4.4.2, and the chalk package was affected in version 5.6.1.
Professional software engineers should check their projects for the presence of the debug and chalk packages. It is recommended to consider using alternative packages or pinning to a known safe version if available. For the debug package, versions fixed include 2.6.9, 3.1.0, 3.2.7, 4.3.1, and 4.4.3. For the chalk package, no fixed version is specified, so alternatives should be considered.
How 0Day mitigates this
debug is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.