Researchers say Sapphire Sleet socially engineered maintainers before publishing malicious updates through trusted accounts

New findings connect the same Pyongyang-backed group to four compromises dating to 2025, revealing a larger operation than previously known.

Amazon links the 2025 debug and chalk npm hijack to Sapphire Sleet with medium confidence, but does not show which evidence ties the incident.