Threat ActorPublished 20 Jun 2026

Microsoft links Mastra AI supply chain attack to North Korean hackers

Source Bleeping Computer

Description

Microsoft has attributed a recent Mastra AI supply chain attack that compromised more than 140 npm packages to the North Korean hacking group Sapphire Sleet, also known as BlueNoroff. [...]

Impact

The attack compromised the integrity of over 140 npm packages in the Mastra AI ecosystem, potentially affecting developers who installed these packages. The malicious dependency deployed malware capable of stealing sensitive credentials, API keys, authentication tokens, and cryptocurrency wallet information across multiple operating systems. This could lead to credential theft, unauthorized access to developer environments, and theft of cryptocurrency assets. The malware also disables TLS verification, increasing the risk of man-in-the-middle attacks during communication with command-and-control servers. The persistence mechanisms and follow-on activity indicate a sustained threat presence on infected systems.

Defensive guidance

Organizations and developers using Mastra AI npm packages should verify the integrity of their dependencies and consider removing or replacing affected packages until official guidance or patches are available. Monitoring for unusual post-install behavior and network communications to suspicious domains may help detect compromise. Follow updates from Microsoft and npm regarding remediation steps and security advisories related to this incident.

References

bleepingcomputer.com/news/security/microsoft-links-mastra-ai-supply-chain-attack-to-north-korean-hackers/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 20 Jun 2026, 14:18 UTC

References

Community reviews