Critical npm Supply Chain Breach: 140+ Mastra Packages Compromised | Developer Security Alert

A sophisticated supply chain attack attributed to Sapphire Sleet, a North Korean state-sponsored hacking group, compromised approximately 140-145 npm packages within the Mastra AI framework ecosystem between June 16-19, 2024/2026. The attackers hijacked the "ehindero" npm maintainer account and injected a malicious typosquatted dependency called "easy-day-js" (impersonating the legitimate dayjs library with 57 million weekly downloads) into affected packages. The attack employed a staged delivery pattern: a clean bait version (1.11.21) was published first to establish credibility, followed by a weaponized version (1.11.22) containing an obfuscated postinstall hook that executed automatically during npm install operations. The malware dropper disabled TLS certificate verification, contacted attacker-controlled command-and-control infrastructure (IP: 23.254.164.92:8000), and downloaded second-stage payloads—cross-platform information stealers targeting Windows, Linux, and macOS systems.

For e-commerce sellers and SaaS developers, this attack carries significant operational risk. The compromised Mastra packages—including mastra-core (918,000+ weekly downloads), mastra-memory, and mastra-server—are widely used in AI application development environments containing sensitive credentials: LLM API keys (OpenAI, Anthropic, Google), cloud provider credentials (AWS, Azure), database tokens, and CI/CD secrets. The malware specifically targeted 166 cryptocurrency wallet browser extensions (MetaMask, Phantom, Coinbase Wallet, Binance Wallet, TronLink), indicating attackers prioritized financial asset theft. Microsoft assessed with high confidence that Sapphire Sleet orchestrated this attack, noting the group primarily targets the financial sector and has a documented history of cryptocurrency theft campaigns, malicious browser extensions, and software supply chain compromises. The group was previously responsible for the April 2024 Axios npm supply chain attack, demonstrating sustained focus on compromising developer tools.

The operational impact extends beyond direct Mastra users. Any developer workstation or CI/CD pipeline running npm install or npm update after the compromised versions were published faced potential exposure. The attack chain involved seven phases: account compromise, typosquat creation using anonymous Tutamail email addresses, mass poisoning of 140 packages with injected dependencies, automatic delivery through semantic versioning resolution, postinstall hook execution, second-stage payload delivery, and post-compromise tradecraft including PowerShell backdoors and persistence mechanisms. Attackers republished 140 packages within 88 minutes (01:12-02:39 UTC), maximizing exposure window. The payload executed during installation regardless of whether the package was imported in application code—a critical vulnerability affecting JavaScript developers globally. Microsoft coordinated with npm security to remove compromised packages and revoke attacker access, but the incident reveals systemic risks in open-source dependency management that directly threaten e-commerce platforms, SaaS providers, and fintech applications relying on JavaScript/Node.js infrastructure.