Amazon Threat Intelligence attributes the typo-crypto, debug, chalk, and axios NPM compromises with medium confidence to a DPRK-linked actor tracked under names including SAPPHIRE SLEET, STARDUST CHOLLIMA, BlueNoroff, CageyChameleon, and Alluring Pisces. The actor socially engineered trusted maintainers and published trojanized updates, allowing a small number of package compromises to reach many downstream environments. The earlier typo-crypto implant contacted npmjs.store, supported Windows, macOS, and Linux payloads, and appears to have tested techniques later used against more popular libraries. Amazon also warns that attackers are distributing malicious behavior across packages, gating execution to evade sandboxes, and using generative AI and indirect prompt injection to defeat automated review.