Microsoft links Mastra AI supply chain attack to North Korean hackers

1. Executive summary

Microsoft has attributed the compromise of more than 140 npm packages in the @mastra scope to the North Korean state-sponsored group Sapphire Sleet (also tracked as BlueNoroff). Attackers hijacked the npm maintainer account ehindero and published malicious updates injecting a typosquatted dependency, easy-day-js (masquerading as the legitimate dayjs library). The malicious package executed a post-install hook that disabled TLS certificate verification, contacted attacker-controlled C2, and deployed a cross-platform second-stage stealer targeting credentials, API keys, authentication tokens, and 166 cryptocurrency wallet browser extensions. Follow-on tradecraft — a PowerShell backdoor, Microsoft Defender exclusions, and a malicious Windows service granting SYSTEM privileges — has been previously associated with Sapphire Sleet. EMEA financial services entities that consume Mastra AI packages, or any downstream project that transitively depends on @mastra/* or easy-day-js, face direct exposure to credential and crypto-asset theft.

2. Regulatory framing

3. Technical analysis & attack chain

1. Initial access — npm maintainer account compromise. Attackers compromised the npm maintainer account ehindero, which held publishing privileges across the Mastra package environment.
2. Malicious publish. Using the hijacked account, the actor published malicious updates to more than 140 packages in the @mastra scope.
3. Typosquatted dependency injection. Each malicious update injected a dependency named easy-day-js — a typosquat of the legitimate, widely-used dayjs JavaScript library.
4. Post-install hook execution. On installation, easy-day-js triggered a post-install hook that: - Executed an obfuscated dropper script. - Disabled TLS certificate verification (defeating certificate-based integrity checks against C2). - Contacted attacker-controlled C2 infrastructure. - Downloaded a second-stage payload. - Executed the payload as a detached hidden process.
5. Second-stage deployment (cross-platform stealer). A cross-platform information stealer targeting Windows, Linux, and macOS. Capabilities include: - Host information collection. - Browser history enumeration. - Enumeration of installed applications. - Enumeration of running processes. - Probing for 166 cryptocurrency wallet browser extensions, including MetaMask, Phantom, Coinbase Wallet, Binance Wallet, and TronLink.
6. OS-specific persistence. - Windows: Registry Run keys. - macOS: LaunchAgents. - Linux: systemd services.
7. Follow-on tradecraft (Sapphire Sleet tradecraft). On systems that communicated with C2: - Deployment of a PowerShell backdoor previously used by the group. - Additional persistence mechanisms. - Microsoft Defender exclusions added to suppress detection. - A malicious Windows service granting SYSTEM privileges.
8. Objective. Theft of credentials, API keys, authentication tokens, and cryptocurrency wallet assets — consistent with Sapphire Sleet's known financial/crypto targeting.

Unconfirmed / single-sourced claims. Microsoft's attribution to Sapphire Sleet is stated with "high confidence" but the named actor (Sapphire Sleet / BlueNoroff) does not have a MITRE ATT&CK profile in the verified reference data supplied with this advisory (which lists only "APT38 — G0082"). Per Adverse Trace policy, the attribution is therefore treated as unconfirmed pending corroboration from an additional independent source. The tradecraft overlap (PowerShell backdoor, Defender exclusions, SYSTEM-service persistence) is consistent with prior Sapphire Sleet activity as described by Microsoft, but the actor-to-campaign link should not be treated as independently verified.

4. Mitigation & containment

P1 — within 24 hours (containment)

• Block at the network layer. Block egress to any C2 infrastructure associated with this campaign at the perimeter and on EDR; deny outbound traffic from developer endpoints to unrecognised hosts. Where specific C2 indicators are not yet available, enforce a default-deny outbound policy for npm post-install hooks and child processes.
• Disable TLS bypass detection. Hunt for and alert on processes that disable certificate verification (e.g., NODE_TLS_REJECT_UNAUTHORIZED=0, openssl invocations with -verify_return_error overrides, .NET ServerCertificateValidationCallback overrides).
• Isolate impacted developer endpoints. Any endpoint that installed an @mastra/* package or easy-day-js since the compromise window must be network-isolated pending forensic triage.
• Revoke and rotate. Rotate any credentials, API keys, tokens, or wallet seeds present on systems that ran the malicious payload. Prioritise cloud, source-control, and CI/CD credentials.
• npm account hardening. Force-rotate the ehindero maintainer credentials and any other maintainers in the @mastra scope; enable 2FA and review publishing tokens.

P2 — within 72 hours (remediation)

• Remove the malicious dependency. Uninstall any package pulling easy-day-js; pin or replace with the legitimate dayjs package. Audit lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock) for the string easy-day-js and remove.
• Patch / version pin. Pin @mastra/* to known-good versions published before the compromise window pending vendor confirmation; do not auto-update until the maintainer account is verified clean.
• Persistence eradication. On Windows: enumerate and remove malicious Registry Run keys and the SYSTEM-privilege Windows service; revert Microsoft Defender exclusions added by the actor. On macOS: remove rogue LaunchAgents under ~/Library/LaunchAgents/ and /Library/LaunchAgents/. On Linux: disable and mask rogue systemd units; inspect /etc/systemd/system/ and ~/.config/systemd/user/.
• EDR / Defender hygiene. Audit the local Defender exclusion list on every affected host; remove any exclusion not explicitly justified by a business application.

P3 — within 7 days (hardening)

• Supply-chain controls. Introduce or tighten: SBOM generation on every build, signed dependency verification, allow-lists for npm scopes in CI/CD, and pre-install hooks that block post-install scripts from untrusted packages.
• Dependency policy. Adopt a policy that any new third-party dependency requires security review; document the exception register for @mastra/* and easy-day-js.
• Detection backlog. Backfill Sigma/YARA detections (see Section 6) into SIEM and EDR; validate with purple-team exercise.

5. Indicators of compromise

package  easy-day-js
package  dayjs
scope    @mastra
account  ehindero

6. Detection

Sigma rule — npm post-install hook and TLS verification bypass

title: Suspicious npm post-install hook disabling TLS verification
id: AT-2026-06-20-133-01
status: experimental
description: >
  Detects npm post-install script execution that disables TLS certificate
  verification, consistent with the easy-day-js dropper behaviour observed
  in the Mastra AI supply chain attack (Sapphire Sleet tradecraft).
author: Adverse Trace
date: 2026-06-20
references:

  - https://www.bleepingcomputer.com/news/security/microsoft-links-mastra-ai-supply-chain-attack-to-north-korean-hackers/
logsource:
  product: process_creation
  category: process_creation
detection:
  selection_npm_postinstall:
    Image|endswith:

      - '\node.exe'
      - '/node'
    CommandLine|contains:

      - 'easy-day-js'
      - 'npm'
    CommandLine|contains:

      - 'postinstall'
  selection_tls_disable:
    CommandLine|contains:

      - 'NODE_TLS_REJECT_UNAUTHORIZED=0'
      - '--insecure'
      - '-k '
  condition: selection_npm_postinstall or selection_tls_disable
fields:

  - User
  - ComputerName
  - CommandLine
  - ParentCommandLine
falsepositives:

  - Legitimate developer tooling that intentionally disables certificate verification in test environments
level: high

YARA rule — easy-day-js dropper artefacts

rule AT_2026_06_20_133_easy_day_js_dropper
{
    meta:
        author      = "Adverse Trace"
        date        = "2026-06-20"
        description = "Detects artefacts associated with the easy-day-js npm dropper used in the Mastra AI supply chain attack"
        reference   = "https://www.bleepingcomputer.com/news/security/microsoft-links-mastra-ai-supply-chain-attack-to-north-korean-hackers/"

    strings:
        $pkg_malicious    = "easy-day-js" ascii wide nocase
        $pkg_typo_target  = "dayjs" ascii wide nocase
        $scope_mastra     = "@mastra" ascii wide nocase
        $account          = "ehindero" ascii wide nocase
        $tls_disable_env  = "NODE_TLS_REJECT_UNAUTHORIZED=0" ascii wide
        $wallet_meta      = "MetaMask" ascii wide nocase
        $wallet_phantom   = "Phantom" ascii wide nocase
        $wallet_coinbase  = "Coinbase Wallet" ascii wide nocase
        $wallet_binance   = "Binance Wallet" ascii wide nocase
        $wallet_tronlink  = "TronLink" ascii wide nocase

    condition:
        any of ($pkg_malicious, $account) or
        (any of ($pkg_typo_target, $scope_mastra) and any of ($tls_disable_env, $wallet_meta, $wallet_phantom, $wallet_coinbase, $wallet_binance, $wallet_tronlink))
}

Threat actor context

APT38 · G0082 · aka NICKEL GLADSTONE, BeagleBoyz, Bluenoroff, Stardust Chollima, Sapphire Sleet

APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau. Active since at least 2014, APT38 has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. …

7. Sources

• BleepingComputer, "Microsoft links Mastra AI supply chain attack to North Korean hackers," 20 June 2026. https://www.bleepingcomputer.com/news/security/microsoft-links-mastra-ai-supply-chain-attack-to-north-korean-hackers/

8. Adverse Trace position

Severity: High for any EMEA financial services entity that consumes @mastra/* packages or transitively depends on easy-day-js; Medium otherwise, pending further indicator release. The tradecraft — npm maintainer hijack, typosquatted dependency, TLS-verification bypass, cross-platform stealer targeting 166 wallet extensions, and follow-on SYSTEM-level persistence — is consistent with a financially motivated North Korean campaign and warrants immediate developer-endpoint and CI/CD pipeline review. Attribution to Sapphire Sleet / BlueNoroff is currently unconfirmed in Adverse Trace's verified reference data and should be treated as a single-sourced Microsoft claim until corroborated. Next steps: (1) monitor for C2 indicator release and update IOC table; (2) track Microsoft's advisory for additional IOCs and a confirmed clean version of @mastra/*; (3) re-assess severity upward if a confirmed-impact financial entity is identified in EMEA.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.