Mastra npm org republished 140+ packages with a dropper dependency

An attacker who controlled a maintainer account in the @mastra npm organization republished more than 140 packages of the Mastra AI agent framework in an 88-minute burst on June 17, 2026, adding a single malicious dependency to each. Microsoft Threat Intelligence later attributed the operation with high confidence to Sapphire Sleet, the North Korean actor also tracked as BlueNoroff and APT38.

Mastra is a TypeScript framework for building AI agents, and its packages draw more than 1.1 million downloads a week between them, with @mastra/core alone at roughly 918,000. That made the organization a good place to reach the sort of developer machine that holds LLM API keys and cloud credentials. Mastra's own incident report described the way in. A compromised LinkedIn account contacted the maintainer, along with maintainers of other prominent TypeScript packages. He was on a call, clicked the link, and his machine was compromised. Two decisions turned that into a registry compromise. The account used to publish, ehindero, belonged to a former contributor whose access had never been revoked, and while Mastra required MFA for npm maintainers it had also, in the project's words, "mistakenly" allowed token bypass. The tokens worked without the second factor.

The dependency the attacker added was easy-day-js, a package built to pass for the widely used dayjs date library. StepSecurity traced the setup: an account named sergey2016 published a clean easy-day-js@1.11.21 at 07:05 UTC on June 16 to establish a plausible history, then released 1.11.22 at 01:01 UTC the next day containing an obfuscated setup.cjs dropper. Between 01:12 and 02:39 UTC the republishing did the rest, injecting the dependency across the ecosystem.

The dropper ran through three layers of obfuscation, wrote beacon files recording its installation paths so the operators could map victims, fetched a second stage from https://23.254.164.92:8000, and deleted itself. Microsoft's write-up placed the target set as LLM API keys, cloud provider credentials, database connection strings, and CI/CD secrets, the same collection profile Sapphire Sleet had used against the axios HTTP client three months earlier. StepSecurity said its Harden Runner product blocked the C2 connection at the network layer for customers, preventing the second stage from arriving. Developers were told to treat any workstation, CI runner, or build system that installed a @mastra/* package after June 16 as compromised.