From package to postinstall payload: Inside the Mastra npm supply chain compromise

Microsoft Threat Intelligence discovered a large-scale npm supply chain attack compromising over 140 packages in the mastra and @mastra scopes. The attack originated from takeover of the ehindero npm maintainer account, which published poisoned package versions introducing easy-day-js, a malicious typosquat of the popular dayjs library. The malicious package executed a postinstall hook that deployed an obfuscated dropper script, disabled TLS certificate verification, contacted command-and-control infrastructure at 23.254.164.92 and 23.254.164.123, and downloaded a second-stage payload. This 41KB cross-platform Node.js implant installed persistence mechanisms, performed cryptocurrency wallet inventory, exfiltrated browser history and host reconnaissance data, and on Windows performed reflective .NET assembly injection for fileless in-memory code execution. Any developer workstation or CI/CD pipeline executing npm install after compromise was potentially exposed regardless of code usage.

• Beyond testmetest: Native Addon Camouflage and 42 Armed GitHub Repositories Reveal a Hidden npm PublisherMalware2026-10-26
• Synacor Zimbra Collaboration Suite (ZCS) · Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570ExploitedVulnerability2026-09-30
• Lunex Unmasked: A New Information Stealer Deployed Through BYOVDMalware2026-09-26
• SEO Poisoning Campaign Delivers New Armorsteal MalwareMalware2026-10-22
• The Stealer Factory: Unpacking a Python-Based MaaS Infostealer BuilderCampaign2026-09-28