NewsPublished 22 Jun 2026

North Korean Hackers Blamed for Mastra NPM Supply Chain Attack

Source SecurityWeek

Description

A malicious dependency the attackers added to over 140 Mastra packages fetches a payload targeting cryptocurrency extensions. The post North Korean Hackers Blamed for Mastra NPM Supply Chain Attack appeared first on SecurityWeek .

Impact

The attack potentially exposed millions of developer workstations and CI/CD pipelines that installed or updated any of the 141 compromised Mastra packages during the attack window. The malware executed during installation, enabling stealthy execution of a payload that targeted cryptocurrency browser extensions and collected system information across major operating systems. This could lead to credential theft, unauthorized access to cryptocurrency wallets, and broader system compromise. The supply chain nature of the attack means downstream applications and services depending on affected packages are at risk. The attack leveraged a compromised maintainer account, highlighting risks in package ecosystem governance.

Defensive guidance

Users who installed any @mastra packages during the attack window on June 17, 2026, should consider their systems compromised. Recommended actions include removing the affected package versions, scanning systems for malware, rotating credentials, tokens, and secrets, and hardening access to cryptocurrency wallets. Follow updates from Microsoft and cybersecurity firms for indicators of compromise and remediation tools.

References

securityweek.com/north-korean-hackers-blamed-for-mastra-npm-supply-chain-attack/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 22 Jun 2026, 11:24 UTC

References

Community reviews