Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleet

Amazon has tied the September 2025 hijack of the npm packages debug and chalk to North Korea. For ten months, the incident sat in the public record as crypto theft: a maintainer phished through a lookalike npm domain and a wallet-draining script pushed into at least 18 packages carrying more than 2 billion weekly downloads between them.

The original Aikido and Wiz reports did not attribute the

Source: The Hacker News

Tags:

Leave a Reply

Your email address will not be published. Required fields are marked *

Explore More

Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs

Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs Apple has moved to address a security flaw in its Hide My Email service that enabled users’

Read More

Ask HN: Add flag for AI-generated articles

Ask HN: Add flag for AI-generated articles Source: Hacker News

Read More

Ruflo MCP Flaw Lets Unauthenticated Attackers Run Commands and Poison AI Memory

Ruflo MCP Flaw Lets Unauthenticated Attackers Run Commands and Poison AI Memory Cybersecurity researchers have flagged a maximum-severity security flaw in Ruflo, an open-source agent meta-harness for Anthropic Claude Code

Read More