On June 17, 2026, the North Korean state-sponsored group Sapphire Sleet conducted a supply chain attack on the Mastra NPM ecosystem by compromising the 'ehindero' maintainer account. During a 45-minute window, they published 141 Mastra packages containing a malicious dependency named easy-day-js, a typosquat of the legitimate dayjs library. This dependency included an obfuscated postinstall dropper that fetched and executed a second-stage payload targeting Windows, macOS, and Linux systems. The malware masqueraded as node-related tools, collected system information, and targeted over 160 cryptocurrency-related browser extensions. The attack exposed any developer or CI/CD pipeline running npm install or npm update during the window, regardless of whether the malicious package was directly imported. The compromised packages have approximately 8 million weekly downloads. The attackers also published a clean version of easy-day-js from a separate account before the compromise to evade detection. Microsoft and multiple cybersecurity firms have published technical details and indicators of compromise. No specific patch or fixed versions have been disclosed.

The attack potentially exposed millions of developer workstations and CI/CD pipelines that installed or updated any of the 141 compromised Mastra packages during the attack window. The malware executed during installation, enabling stealthy execution of a payload that targeted cryptocurrency browser extensions and collected system information across major operating systems. This could lead to credential theft, unauthorized access to cryptocurrency wallets, and broader system compromise. The supply chain nature of the attack means downstream applications and services depending on affected packages are at risk. The attack leveraged a compromised maintainer account, highlighting risks in package ecosystem governance.

Users who installed any @mastra packages during the attack window on June 17, 2026, should consider their systems compromised. Recommended actions include removing the affected package versions, scanning systems for malware, rotating credentials, tokens, and secrets, and hardening access to cryptocurrency wallets. Since no official patch or fixed versions have been published, users should avoid installing or updating affected packages until further guidance is provided by Mastra maintainers or the NPM registry. Follow updates from Microsoft and cybersecurity firms for indicators of compromise and remediation tools.