The break is in the trusted maintainer path. Amazon is no longer treating the debug and chalk hijacks as separate npm incidents; it is folding them into one long-running Sapphire Sleet supply-chain pattern that can ride normal package updates into browser-delivered code.
Amazon says the same group was behind the earlier typo-crypto package and the later axios compromise, linking four named packages across three campaigns in twelve months. The affected packages include debug, chalk, axios, and typo-crypto, and the debug/chalk incident reached more than 2 billion weekly downloads across at least 18 packages.
The practical risk is that patching a single package does not restore trust in the path that delivered it. For npm-heavy teams, the threat now sits in maintainer accounts and update flow itself, not only in obvious malicious packages.