A recent supply chain attack on the Mastra AI npm packages was attributed by Microsoft to the North Korean hacking group Sapphire Sleet (BlueNoroff). The attackers hijacked the npm maintainer account 'ehindero' to publish malicious updates to more than 140 packages within the @mastra scope. These updates introduced a malicious dependency named 'easy-day-js', a typosquat of the legitimate 'dayjs' library. Upon installation, this dependency executed a post-install hook that deployed an obfuscated malware dropper, disabled TLS certificate verification, and communicated with attacker-controlled command-and-control infrastructure. The second-stage payload was a cross-platform information stealer targeting Windows, Linux, and macOS, designed to collect host information, browser histories, installed applications, running processes, and detect 166 cryptocurrency wallet browser extensions. The malware used OS-specific persistence methods and was followed by additional malicious activity consistent with Sapphire Sleet's known tactics, including deployment of a PowerShell backdoor and privilege escalation. This attack aligns with Sapphire Sleet's history of cryptocurrency theft and supply chain compromises. No patch or remediation details are provided in the source.

The attack compromised the integrity of over 140 npm packages in the Mastra AI ecosystem, potentially affecting developers who installed these packages. The malicious dependency deployed malware capable of stealing sensitive credentials, API keys, authentication tokens, and cryptocurrency wallet information across multiple operating systems. This could lead to credential theft, unauthorized access to developer environments, and theft of cryptocurrency assets. The malware also disables TLS verification, increasing the risk of man-in-the-middle attacks during communication with command-and-control servers. The persistence mechanisms and follow-on activity indicate a sustained threat presence on infected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations and developers using Mastra AI npm packages should verify the integrity of their dependencies and consider removing or replacing affected packages until official guidance or patches are available. Monitoring for unusual post-install behavior and network communications to suspicious domains may help detect compromise. Follow updates from Microsoft and npm regarding remediation steps and security advisories related to this incident.