One Maintainer Compromise Can Poison the npm Stack
Amazon’s new read on these incidents is that they are one campaign, not four isolated package problems. The break is the trust path: if an attacker gets a real maintainer to publish a routine update, the malicious code rides in through normal dependency automation and reaches downstream builds as if it were legitimate.
Amazon ties SapphireSleet to compromises of typo-crypto, debug, chalk, and axios. It says axios alone is downloaded more than 100 million times each week, which turns a single poisoned package into a distribution path for thousands of apps and services.
The risk is broader than any one library. If your team auto-installs npm updates or consumes transitive dependencies, the attacker’s leverage sits in the maintainer relationship and the update channel, not just in the package name.