144 Mastra npm Packages Compromised in 'easy-day-js' Supply Chain Attack
Attackers hijacked a former contributor's npm account to publish malicious versions of 144 @mastra/* packages, deploying a cryptocurrency-stealing infostealer via a cloned dayjs library.
As many as 144 npm packages in the @mastra/* namespace, part of the popular Mastra AI framework for building JavaScript and TypeScript AI applications, were compromised in a supply chain attack dubbed easy-day-js. Researchers from JFrog, SafeDep, Socket, and StepSecurity identified the incident, which exploited a single contributor account (ehindero) whose scope access was never revoked after the contributor left the project. The attacker mass-published malicious versions of the packages within a short window on June 17, 2026, targeting developers who rely on Mastra for AI application development.
The infected packages themselves do not contain malicious code directly. Instead, the attack introduces a third-party library named "easy-day-js" as a dependency. This library, published by npm user "sergey2016" on June 16, 2026, initially appeared as a clean copy of the legitimate dayjs date library. The malicious changes were introduced on June 17, 2026, at 1:01 a.m. UTC, turning the library into a dropper for a second-stage payload.
During installation, the easy-day-js package executes an obfuscated payload via a postinstall hook. This payload acts as a loader, retrieving a second-stage payload from attacker-controlled infrastructure at IP address 23.254.164[.]92 after disabling TLS certificate validation. The loader then executes the payload as a detached background process and erases itself to minimize forensic evidence.
The final stage is a cross-platform information stealer capable of harvesting browser history, stealing data from over 160 cryptocurrency wallet browser extensions, and establishing persistence across Windows, macOS, and Linux. Captured information is exfiltrated to a command-and-control server at 23.254.164[.]123. SafeDep described the attack as a clone of the dayjs library that downloads and runs a cryptocurrency-stealing remote access trojan.
The attack exploited a critical oversight in Mastra's npm publishing workflow. While Mastra ships its real releases from CI through npm's trusted publisher flow with SLSA provenance attestations, the attacker pushed malicious versions using a personal token that lacked provenance. As SafeDep noted, "Mastra generated provenance on CI publishes but did not require it, so a standard npm token could still publish without attestations." A signature-verifying install (npm audit signatures or a policy requiring attestations) would have rejected every malicious package.
The affected packages include @mastra/core, which receives more than 918,000 weekly npm downloads, giving the campaign a large potential blast radius. Because the payload executes during installation, systems may be exposed before developers import or use the package. npm has since pulled the malicious versions from the highest-profile packages and reverted their latest tag.
Any workstation, CI runner, or build environment that installed the affected versions should be treated as potentially compromised. Users are advised to roll back to a safe version, rotate any credentials exposed during the incident, and audit hosts for artifacts linked to the campaign. The incident underscores the ongoing risk of supply chain attacks targeting the npm ecosystem, particularly through hijacked contributor accounts with lingering access permissions.
Microsoft and Socket jointly disclosed full technical details of the attack chain on June 17, revealing that the compromised @mastra/core package (over 918,000 weekly downloads) injected a typosquatted 'easy-day-js' dependency containing a multi-stage infostealer. The implant targets 166 cryptocurrency wallet extensions, browser history, and credentials, establishing persistence via Registry keys, LaunchAgents, and systemd units disguised as legitimate Node.js tooling. Developers are advised to treat any system that ran npm install on affected versions as fully compromised and to immediately rotate all credentials, including npm tokens, GitHub tokens, and CI/CD secrets.
Microsoft's threat intelligence group confirmed the attack began after an attacker compromised legitimate Mastra credentials, and that the malicious dependency was published by a single anonymous maintainer 24 hours before disclosure. StepSecurity detailed the technique: the attacker pinned the typosquatted 'easy-day-js' dependency with a caret range (^1.11.21), so that once the malicious version 1.11.22 was published, every fresh npm install automatically pulled the payload without requiring further changes to the @mastra packages. The article also links the attack to the TeamPCP/UNC6780 group and its self-replicating npm worm Shai-Hulud, noting that the campaign earlier this month compromised at least 151 repositories across 26 organizations.
Microsoft's detailed analysis adds new technical depth, revealing that the attacker published two versions of the typosquat in a staged delivery pattern — a clean bait version (easy-day-js@1.11.21) followed by the weaponized 1.11.22. The obfuscated 4,572-byte dropper disabled TLS certificate verification before contacting C2 infrastructure, and the second-stage payload was spawned as a hidden, detached Node.js process. Microsoft also noted that all previous Mastra versions were published via GitHub Actions OIDC, while the malicious v1.13.1 was manually published using an anonymous Tutamail address, providing a clear detection signal for defenders.
Microsoft has now attributed the attack to the North Korean state-sponsored group Sapphire Sleet (BlueNoroff) with high confidence, noting that the group used a PowerShell backdoor and C2 infrastructure consistent with prior campaigns. The attackers also deployed additional persistence mechanisms, Microsoft Defender exclusions, and a malicious Windows service granting SYSTEM privileges on compromised systems. This attribution follows Microsoft's earlier disclosure of the npm maintainer account hijack and aligns with Sapphire Sleet's history of cryptocurrency theft and supply chain attacks, including a separate npm attack on Axios in April 2026.
Microsoft has attributed the attack to the North Korean state-sponsored group Sapphire Sleet, which compromised the ehindero npm maintainer account to push malicious code into over 140 Mastra packages. The campaign deployed a memory-resident implant on Windows systems that collects cryptocurrency wallet extensions and browsing history, with persistence achieved via registry Run keys, LaunchAgents, or systemd services. Microsoft identified the compromise through unusual publishing patterns and recommends developers review dependency trees for affected packages and use the --ignore-scripts flag during npm install.
Microsoft has now formally attributed the attack to the North Korean state-sponsored group Sapphire Sleet (also tracked as BlueNoroff, CageyChameleon, Copernicium, and Stardust Chollima), which was previously linked to the Axios NPM supply chain attack in April. The malicious easy-day-js dependency was designed to target over 160 cryptocurrency-related browser extensions across Windows, macOS, and Linux, executing a second-stage payload as a hidden background process that masquerades as node-related tools. Multiple cybersecurity firms—including Aikido, Ox, Socket, Sonatype, and StepSecurity—have published technical details and indicators of compromise to assist with detection and remediation.
Microsoft's threat intelligence team has now formally attributed the Mastra supply chain compromise to the North Korean state-sponsored group Sapphire Sleet, linking the attack to a broader pattern of cryptocurrency theft and espionage operations. The attribution provides a geopolitical dimension to the incident, which previously had been described only as an opportunistic hijacking of npm accounts. Microsoft's analysis of the group's infrastructure and tactics confirms that the malicious packages were designed to deploy a cryptocurrency-stealing infostealer, consistent with North Korea's known targeting of digital asset platforms.