breach
North Korea Poisons 140+ Mastra AI npm Packages
2026-06-21
Microsoft has tied this week's Mastra AI supply chain attack to Sapphire Sleet, the North Korean group also tracked as BlueNoroff. They mostly chase cryptocurrency and financial credentials, and this campaign sits comfortably inside that pattern.
The way in was an npm maintainer account, ehindero, which held publishing rights across the entire @mastra scope. From there, the attackers pushed malicious updates to more than 140 packages. Each one quietly added a new dependency called easy-day-js, a deliberate misspelling of dayjs, the wildly popular JavaScript date library. The sort of name a developer would scan past without thinking twice.
What the payload actually did
Installing any of the poisoned packages fired a post-install script that disabled TLS certificate checks, called out to attacker infrastructure, and pulled down a second-stage info stealer with builds for Windows, macOS and Linux. Once running, it scraped browser history, running processes, API keys and authentication tokens.
It also went looking, very specifically, for 166 different cryptocurrency wallet extensions, including MetaMask, Phantom, Coinbase Wallet and TronLink. Persistence was tailored per operating system:
- Registry Run keys on Windows
- LaunchAgents on macOS
- systemd services on Linux
On hosts that kept chatting back to the command-and-control infrastructure, Microsoft observed the next stage of the playbook: a PowerShell backdoor Sapphire Sleet has used in previous campaigns, Microsoft Defender exclusions being added, and a malicious Windows service running as SYSTEM.
A pattern, not a one-off
The same group was tied to the Axios npm compromise earlier this year, which suggests poisoning popular Node ecosystems is becoming a fixture in their toolkit rather than a one-time experiment. Pick a maintainer with broad publishing rights, get into the account, ship a quiet update with a plausibly named dependency, and wait.
What makes this kind of attack so awkward to defend against is how mundane the trigger is. A developer pulls the latest version of a library they have used for months, runs npm install, makes a coffee, and a state-sponsored stealer is already going through their browser profiles and wallet extensions. There is no suspicious email, no dodgy attachment, no obvious moment to be sceptical.
What's actually helping right now
The defences doing the heavy lifting in stories like this are unglamorous:
- Maintainer account hygiene. Strong, phishing-resistant MFA on every account with publish rights, and aggressive review of who actually needs that access.
- Lockfiles and pinned versions. If your build is faithfully resolving to whatever the registry served up five minutes ago, you are one bad update away from a bad day.
- A healthy suspicion of unfamiliar dependencies. A new transitive package called easy-day-js appearing next to dayjs deserves at least one raised eyebrow before it lands in production.
None of this is novel advice. It is just the advice that keeps quietly being right while attackers like Sapphire Sleet keep finding maintainers who haven't taken it yet.