Microsoft Threat Intelligence identified a supply chain compromise affecting over 140 npm packages within the mastra and @mastra namespaces. The compromise stemmed from an account takeover of the ehindero npm maintainer, who published poisoned package versions containing easy-day-js, a malicious typosquat of the legitimate dayjs library. The malicious package leveraged a postinstall hook to execute an obfuscated dropper script that disabled TLS certificate verification and communicated with command-and-control servers at IPs 23.254.164.92 and 23.254.164.123. It then downloaded a 41KB cross-platform Node.js implant that established persistence, performed cryptocurrency wallet inventory, exfiltrated browser history and reconnaissance data, and on Windows used reflective .NET assembly injection for fileless in-memory code execution. This attack vector exposed any environment performing npm install on these compromised packages, including developer workstations and CI/CD pipelines, regardless of whether the malicious code was explicitly used.

The attack compromises developer and CI/CD environments by executing malicious code during npm install, potentially leading to credential theft, cryptocurrency wallet compromise, data exfiltration, and persistent implant installation. The malicious payload disables TLS verification, increasing risk of man-in-the-middle attacks. On Windows, reflective .NET assembly injection enables stealthy, fileless execution, complicating detection and remediation. The supply chain nature means many downstream projects and organizations could be affected simply by installing these compromised packages.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until official fixes or removals are confirmed, developers and organizations should audit their dependencies for packages in the mastra and @mastra scopes, especially easy-day-js and related typosquats. Avoid running npm install on untrusted or suspicious packages. Monitor for indicators of compromise such as connections to the known command-and-control IPs (23.254.164.92 and 23.254.164.123) and hashes associated with the malicious payload. Follow updates from npm and Microsoft security advisories for official remediation steps.