Amazon attributed multiple npm supply chain attacks to the North Korean threat actor Sapphire Sleet (also known as BlueNoroff and Stardust Chollima). The campaign began in March 2025 with the trojanization of the 'typo-crypto' package, used as a testing ground. In September 2025, the widely used 'debug' and 'chalk' packages were compromised, affecting an estimated 10% of cloud environments within two hours. In March 2026, the 'axios' package (100M+ weekly downloads) was targeted. Attackers gained access by socially engineering package maintainers and publishing malicious updates automatically distributed to users. Key TTPs include: splitting malicious functionality across multiple benign-looking packages; spending months building trust before introducing malicious code; decoupling malicious behavior from package contents via external scripts or remote servers; using strong encryption and multi-stage payloads with runtime or remotely fetched keys; environment-aware payloads that delay execution unless real developer or production environments are detected; and exploiting 'slopsquatting' by registering package names hallucinated by AI coding assistants. AI tools were used to generate code, documentation, and fake maintainer identities. Attribution is medium-confidence based on shared TTPs, C2 infrastructure, and operational similarities. Financial motivation is suspected.