Microsoft links Mastra AI supply chain attack to North Korean hackers

Mastra AI npm Supply Chain Attack Attributed to Sapphire Sleet (BlueNoroff)

IntroductionA recent security update from a major technology company ties a high-profile supply chain incident to a North Korean threat actor. The Mastra AI npm ecosystem, used by developers around the world, was targeted through a compromised maintainer account. The operation led to the publication of malicious package updates and the deployment of a cross-platform information-stealing payload. The attribution points to Sapphire Sleet, also known as BlueNoroff, a North Korean group with a history of cryptocurrency-related theft and supply chain intrusions.

How the attack unfolded

• Initial foothold: Attackers gained access to an npm maintainer account with publishing rights across the Mastra package set. This account, identified as ehindero, was trusted within the Mastra environment and used to push updates to numerous packages.
• Malicious updates: From this foothold, the intruders published updates for more than 140 packages in the Mastra scope. Each malicious update introduced a tainted dependency designed to pull in further malware.
• The malicious dependency: The newly added dependency, named easy-day-js, is a deliberate misspelling (typosquat) of the legitimate dayjs library. When installed, it triggered a post-install sequence that concealed a dropper on user machines.
• Execution chain after installation: The post-install hook ran an obfuscated script that disabled TLS certificate verification, reached out to attacker-controlled servers, downloaded a second-stage payload, and executed the payload as a hidden process.
• Cross-platform goal: The second-stage payload was designed to operate on Windows, Linux, and macOS, collecting a wide range of information from the host system.

Technical details of the malware

• Data collection scope: The second-stage payload gathered host details, browser history, installed applications, and active processes. It specifically checked for a large set of cryptocurrency wallet browser extensions, including MetaMask, Phantom, Coinbase Wallet, Binance Wallet, and TronLink.
• Persistence and evasion: The malware employed multiple persistence techniques tailored to each operating system, such as Windows Registry Run keys, macOS LaunchAgents, and Linux systemd services. It also included mechanisms to evade standard security checks and detection.
• Command-and-control and backdoors: Communication with attacker-controlled infrastructure enabled the deployment of a PowerShell backdoor that had been used in prior campaigns. Additional persistence methods, Defender exclusions, and a malicious Windows service granting SYSTEM privileges were observed in the activity linked to this operation.
• Observed tradecraft: The PowerShell backdoor, the specific persistence techniques, and the C2 setup align with tactics previously attributed to Sapphire Sleet in other campaigns. The combination of supply chain compromise, stealthy post-install actions, and cross-platform capabilities reflects a coordinated and adaptable intrusion kit.

Actor background and historical context

• Sapphire Sleet/BlueNoroff profile: This North Korean state-sponsored group has been linked to cryptocurrency theft campaigns, malicious browser extensions, and supply chain compromises aimed at credential theft and digital asset extraction.
• Notable related activity: The same actor was associated with another npm supply chain incident targeting the Axios HTTP client earlier in 2026. That event demonstrated a pattern of infiltrating open-source ecosystems to insert malicious payloads that facilitate credential harvesting and asset theft.
• Sector targets and strategy: The group often targets financial-related infrastructure and tech development environments, leveraging trusted software channels to reach developers and organizations with minimal friction.

Impact and broader implications

• Scope of exposure: The attack affected a broad swath of developers relying on Mastra AI packages, illustrating how a single compromised maintainer account can cascade into a large number of downstream victims.
• Credential and asset risk: By design, the malware sought to harvest credentials, API keys, authentication tokens, and cryptocurrency wallets, creating the potential for fraudulent transactions and asset loss.
• Cross-platform reach: The ability to operate on Windows, macOS, and Linux broadens the potential impact across diverse development environments and CI/CD pipelines.
• Ongoing threat landscape: This incident reinforces the ongoing risk of supply chain attacks in open-source ecosystems and the importance of monitoring maintainer accounts, verifying package integrity, and understanding dependencies in critical projects.

Related topics and broader context

• Supply chain attack patterns: The Mastra incident fits a broader class of supply chain compromises where trusted software channels are abused to inject malicious code. Such attacks highlight the need for rigorous supply chain hygiene in modern development.
• Notable neighbor incidents: Other reported campaigns attributed to Sapphire Sleet include malicious browser extensions and social-engineering tactics, underscoring the actor’s multi-vector approach to gaining and expanding access.

Security observations and takeaways (contextual)

• Detection challenges: Incidents of this kind demonstrate how a single compromised account can seed large-scale harm before detection, even when security controls exist in the environment.
• Importance of layered defenses: The integration of code signing validation, package integrity checks, and anomaly detection across the supply chain can help illuminate malicious changes before they propagate widely.
• Continuous monitoring of dependencies: Regular audits of dependencies, as well as rapid rotation and verification of transitive packages, are crucial to reducing exposure to typosquats and other dependency-based threats.

Closing perspectiveThe attribution of the Mastra AI supply chain attack to Sapphire Sleet marks another chapter in the ongoing struggle against state-sponsored cyber threats targeting software supply chains. By leveraging a trusted maintainer account and a carefully crafted multi-stage payload, the actors demonstrated both precision and scale in their approach. The incident reinforces the need for vigilant maintenance of dependencies, rigorous verification of package provenance, and continued investment in resilient security practices across development environments.