> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Microsoft links Mastra AI supply chain attack to North Korean hackers - URL: https://f4n6.co.uk/security-feed/microsoft-links-mastra-ai-supply-chain-attack-to-north-korean-hackers/ - Published: 2026-06-20T22:40:42.000Z - Updated: 2026-06-20T22:40:42.000Z - Author: Jeff Davies - Tags: #security-feed, Sapphire Sleet, BlueNoroff ## 1\. Executive summary Microsoft has attributed the compromise of more than 140 npm packages in the `@mastra` scope to the North Korean state-sponsored group **Sapphire Sleet** (also tracked as BlueNoroff). Attackers hijacked the npm maintainer account `ehindero` and published malicious updates injecting a typosquatted dependency, `easy-day-js` (masquerading as the legitimate `dayjs` library). The malicious package executed a post-install hook that disabled TLS certificate verification, contacted attacker-controlled C2, and deployed a cross-platform second-stage stealer targeting credentials, API keys, authentication tokens, and 166 cryptocurrency wallet browser extensions. Follow-on tradecraft — a PowerShell backdoor, Microsoft Defender exclusions, and a malicious Windows service granting SYSTEM privileges — has been previously associated with Sapphire Sleet. EMEA financial services entities that consume Mastra AI packages, or any downstream project that transitively depends on `@mastra/*` or `easy-day-js`, face direct exposure to credential and crypto-asset theft. ## 2\. Regulatory framing | Article | Trigger | Practical impact | | -------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28 (ICT third-party risk — general principles) | Mastra AI / npm constitute ICT third-party software dependencies used in development and production pipelines | Financial entities must reassess third-party risk register entries covering @mastra/\* packages and any project transitively pulling easy-day-js; document the exposure and apply proportionate controls. | | DORA Art. 29 (preliminary assessment of ICT concentration risk) | Widespread use of a single npm scope (@mastra) across many internal projects creates concentration risk | Conduct a concentration-risk assessment: enumerate projects depending on @mastra/\* and quantify blast radius before remediation. | | DORA Art. 30 (key contractual provisions with ICT third-party providers) | Vendor (Mastra AI) and its supply chain (npm registry) are ICT third-party providers | Verify contractual clauses covering supplier incident notification, audit rights, and exit/transition assistance are sufficient to compel timely disclosure and remediation. | | NIS2 Art. 21(2)(d) (supply chain security measures) | Confirmed supply-chain compromise of a widely-used software dependency | In-scope entities must evaluate supply-chain security controls (SBOM, dependency pinning, integrity verification) against this incident and evidence proportionate improvements. | | DORA Art. 17 (ICT-related incident management process) | Confirmed malicious code execution on developer endpoints and downstream systems | Activate the ICT-related incident management process; ensure detection, containment, eradication, and recovery steps are documented and tested against this scenario. | | DORA Art. 18 (classification of ICT-related incidents and cyber threats) | Incident requires classification against ICT-related incident taxonomy | Classify the event per the entity's scheme; record criteria used (e.g., affected systems, data sensitivity, propagation). | | DORA Art. 19 (reporting of major ICT-related incidents to competent authorities) | If the incident meets the "major" threshold once classified | Prepare initial notification within the regulatory reporting window; preserve evidence before remediation erases forensic artefacts. | | DORA Art. 24 (digital operational resilience testing — general requirements) | Supply-chain compromise scenario must be covered by testing programme | Ensure vulnerability management and scenario-based testing explicitly cover third-party/dependency compromise; feed lessons learned into the test plan. | | NIS2 Art. 23 (incident reporting obligations) | If the in-scope entity suffers confirmed impact | Prepare early warning and incident notification per the prescribed timeline; align with CSIRT coordination requirements. | | UK NIS 2018 (OES/RDSP duties) | If an affected system supports an essential service (e.g., financial market infrastructure) | Assess whether the incident triggers reporting duties to the competent authority under UK NIS. | ## 3\. Technical analysis & attack chain 1. **Initial access — npm maintainer account compromise.** Attackers compromised the npm maintainer account `ehindero`, which held publishing privileges across the Mastra package environment. 2. **Malicious publish.** Using the hijacked account, the actor published malicious updates to more than 140 packages in the `@mastra` scope. 3. **Typosquatted dependency injection.** Each malicious update injected a dependency named `easy-day-js` — a typosquat of the legitimate, widely-used `dayjs` JavaScript library. 4. **Post-install hook execution.** On installation, `easy-day-js` triggered a post-install hook that: - Executed an obfuscated dropper script. - Disabled TLS certificate verification (defeating certificate-based integrity checks against C2). - Contacted attacker-controlled C2 infrastructure. - Downloaded a second-stage payload. - Executed the payload as a **detached hidden process**. 5. **Second-stage deployment (cross-platform stealer).** A cross-platform information stealer targeting Windows, Linux, and macOS. Capabilities include: - Host information collection. - Browser history enumeration. - Enumeration of installed applications. - Enumeration of running processes. - Probing for **166 cryptocurrency wallet browser extensions**, including MetaMask, Phantom, Coinbase Wallet, Binance Wallet, and TronLink. 6. **OS-specific persistence.** \- **Windows:** Registry Run keys. - **macOS:** LaunchAgents. - **Linux:** systemd services. 7. **Follow-on tradecraft (Sapphire Sleet tradecraft).** On systems that communicated with C2: - Deployment of a PowerShell backdoor previously used by the group. - Additional persistence mechanisms. - **Microsoft Defender exclusions** added to suppress detection. - A malicious Windows service granting **SYSTEM privileges**. 8. **Objective.** Theft of credentials, API keys, authentication tokens, and cryptocurrency wallet assets — consistent with Sapphire Sleet's known financial/crypto targeting. **Unconfirmed / single-sourced claims.** Microsoft's attribution to Sapphire Sleet is stated with "high confidence" but the named actor (Sapphire Sleet / BlueNoroff) does not have a MITRE ATT&CK profile in the verified reference data supplied with this advisory (which lists only "APT38 — G0082"). Per Adverse Trace policy, the attribution is therefore treated as **unconfirmed** pending corroboration from an additional independent source. The tradecraft overlap (PowerShell backdoor, Defender exclusions, SYSTEM-service persistence) is consistent with prior Sapphire Sleet activity as described by Microsoft, but the actor-to-campaign link should not be treated as independently verified. ## 4\. Mitigation & containment ### P1 — within 24 hours (containment) - **Block at the network layer.** Block egress to any C2 infrastructure associated with this campaign at the perimeter and on EDR; deny outbound traffic from developer endpoints to unrecognised hosts. Where specific C2 indicators are not yet available, enforce a default-deny outbound policy for npm post-install hooks and child processes. - **Disable TLS bypass detection.** Hunt for and alert on processes that disable certificate verification (e.g., `NODE_TLS_REJECT_UNAUTHORIZED=0`, `openssl` invocations with `-verify_return_error` overrides, .NET `ServerCertificateValidationCallback` overrides). - **Isolate impacted developer endpoints.** Any endpoint that installed an `@mastra/*` package or `easy-day-js` since the compromise window must be network-isolated pending forensic triage. - **Revoke and rotate.** Rotate any credentials, API keys, tokens, or wallet seeds present on systems that ran the malicious payload. Prioritise cloud, source-control, and CI/CD credentials. - **npm account hardening.** Force-rotate the `ehindero` maintainer credentials and any other maintainers in the `@mastra` scope; enable 2FA and review publishing tokens. ### P2 — within 72 hours (remediation) - **Remove the malicious dependency.** Uninstall any package pulling `easy-day-js`; pin or replace with the legitimate `dayjs` package. Audit lockfiles (`package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`) for the string `easy-day-js` and remove. - **Patch / version pin.** Pin `@mastra/*` to known-good versions published before the compromise window pending vendor confirmation; do not auto-update until the maintainer account is verified clean. - **Persistence eradication.** On Windows: enumerate and remove malicious Registry Run keys and the SYSTEM-privilege Windows service; revert Microsoft Defender exclusions added by the actor. On macOS: remove rogue LaunchAgents under `~/Library/LaunchAgents/` and `/Library/LaunchAgents/`. On Linux: disable and mask rogue systemd units; inspect `/etc/systemd/system/` and `~/.config/systemd/user/`. - **EDR / Defender hygiene.** Audit the local Defender exclusion list on every affected host; remove any exclusion not explicitly justified by a business application. ### P3 — within 7 days (hardening) - **Supply-chain controls.** Introduce or tighten: SBOM generation on every build, signed dependency verification, allow-lists for npm scopes in CI/CD, and pre-install hooks that block post-install scripts from untrusted packages. - **Dependency policy.** Adopt a policy that any new third-party dependency requires security review; document the exception register for `@mastra/*` and `easy-day-js`. - **Detection backlog.** Backfill Sigma/YARA detections (see Section 6) into SIEM and EDR; validate with purple-team exercise. ## 5\. Indicators of compromise | Type | Value | Confidence | Source | | -------------------------------------- | --------------------------------------------------------------------------- | ---------- | ---------------------------- | | npm package (malicious) | easy-day-js | High | BleepingComputer / Microsoft | | npm package (legitimate, typosquatted) | dayjs | High | BleepingComputer / Microsoft | | npm scope (affected) | @mastra (140+ packages) | High | BleepingComputer / Microsoft | | npm maintainer account (compromised) | ehindero | High | BleepingComputer / Microsoft | | Persistence (Windows) | Registry Run keys | Medium | BleepingComputer / Microsoft | | Persistence (macOS) | LaunchAgents | Medium | BleepingComputer / Microsoft | | Persistence (Linux) | systemd services | Medium | BleepingComputer / Microsoft | | Privilege escalation artefact | Malicious Windows service granting SYSTEM privileges | Medium | BleepingComputer / Microsoft | | Defence evasion artefact | Microsoft Defender exclusions added by actor | Medium | BleepingComputer / Microsoft | | Targeted wallet extensions (subset) | MetaMask, Phantom, Coinbase Wallet, Binance Wallet, TronLink (of 166 total) | High | BleepingComputer / Microsoft | ```iocs package easy-day-js package dayjs scope @mastra account ehindero ``` ## 6\. Detection ### Sigma rule — npm post-install hook and TLS verification bypass ```yaml title: Suspicious npm post-install hook disabling TLS verification id: AT-2026-06-20-133-01 status: experimental description: > Detects npm post-install script execution that disables TLS certificate verification, consistent with the easy-day-js dropper behaviour observed in the Mastra AI supply chain attack (Sapphire Sleet tradecraft). author: Adverse Trace date: 2026-06-20 references: - https://www.bleepingcomputer.com/news/security/microsoft-links-mastra-ai-supply-chain-attack-to-north-korean-hackers/ logsource: product: process_creation category: process_creation detection: selection_npm_postinstall: Image|endswith: - '\node.exe' - '/node' CommandLine|contains: - 'easy-day-js' - 'npm' CommandLine|contains: - 'postinstall' selection_tls_disable: CommandLine|contains: - 'NODE_TLS_REJECT_UNAUTHORIZED=0' - '--insecure' - '-k ' condition: selection_npm_postinstall or selection_tls_disable fields: - User - ComputerName - CommandLine - ParentCommandLine falsepositives: - Legitimate developer tooling that intentionally disables certificate verification in test environments level: high ``` ### YARA rule — easy-day-js dropper artefacts ```yara rule AT_2026_06_20_133_easy_day_js_dropper { meta: author = "Adverse Trace" date = "2026-06-20" description = "Detects artefacts associated with the easy-day-js npm dropper used in the Mastra AI supply chain attack" reference = "https://www.bleepingcomputer.com/news/security/microsoft-links-mastra-ai-supply-chain-attack-to-north-korean-hackers/" strings: $pkg_malicious = "easy-day-js" ascii wide nocase $pkg_typo_target = "dayjs" ascii wide nocase $scope_mastra = "@mastra" ascii wide nocase $account = "ehindero" ascii wide nocase $tls_disable_env = "NODE_TLS_REJECT_UNAUTHORIZED=0" ascii wide $wallet_meta = "MetaMask" ascii wide nocase $wallet_phantom = "Phantom" ascii wide nocase $wallet_coinbase = "Coinbase Wallet" ascii wide nocase $wallet_binance = "Binance Wallet" ascii wide nocase $wallet_tronlink = "TronLink" ascii wide nocase condition: any of ($pkg_malicious, $account) or (any of ($pkg_typo_target, $scope_mastra) and any of ($tls_disable_env, $wallet_meta, $wallet_phantom, $wallet_coinbase, $wallet_binance, $wallet_tronlink)) } ``` ## Threat actor context **APT38** · [G0082](https://attack.mitre.org/groups/G0082?ref=f4n6.co.uk) · aka NICKEL GLADSTONE, BeagleBoyz, Bluenoroff, Stardust Chollima, Sapphire Sleet [APT38](https://attack.mitre.org/groups/G0082?ref=f4n6.co.uk) is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau. Active since at least 2014, [APT38](https://attack.mitre.org/groups/G0082?ref=f4n6.co.uk) has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. … ## 7\. Sources - BleepingComputer, "Microsoft links Mastra AI supply chain attack to North Korean hackers," 20 June 2026\. https://www.bleepingcomputer.com/news/security/microsoft-links-mastra-ai-supply-chain-attack-to-north-korean-hackers/ ## 8\. Adverse Trace position **Severity: High** for any EMEA financial services entity that consumes `@mastra/*` packages or transitively depends on `easy-day-js`; **Medium** otherwise, pending further indicator release. The tradecraft — npm maintainer hijack, typosquatted dependency, TLS-verification bypass, cross-platform stealer targeting 166 wallet extensions, and follow-on SYSTEM-level persistence — is consistent with a financially motivated North Korean campaign and warrants immediate developer-endpoint and CI/CD pipeline review. Attribution to Sapphire Sleet / BlueNoroff is currently **unconfirmed** in Adverse Trace's verified reference data and should be treated as a single-sourced Microsoft claim until corroborated. Next steps: (1) monitor for C2 indicator release and update IOC table; (2) track Microsoft's advisory for additional IOCs and a confirmed clean version of `@mastra/*`; (3) re-assess severity upward if a confirmed-impact financial entity is identified in EMEA. --- [Read the original source →](https://www.bleepingcomputer.com/news/security/microsoft-links-mastra-ai-supply-chain-attack-to-north-korean-hackers/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*