Amazon links the 2025 debug and chalk npm hijack to Sapphire Sleet with medium confidence, but does not show which evidence ties the incident.

Amazon links the 2025 debug and chalk npm hijack to Sapphire Sleet with medium confidence, but does not show which evidence ties the incident.

Researchers say Sapphire Sleet socially engineered maintainers before publishing malicious updates through trusted accounts