North Korean Hackers Used Mastra npm Packages to Target Developers and CI/CD Pipelines

North Korean state-backed hackers poisoned more than 140 npm packages in the Mastra ecosystem, turning a trusted developer dependency chain into a malware delivery channel for workstations and CI/CD pipelines.

Microsoft Threat Intelligence attributes the campaign with high confidence to Sapphire Sleet, a North Korean threat actor also known as BlueNoroff. The group mainly targets the financial sector, cryptocurrency companies, developers, and software supply chains.

The attack started with the compromise of the ehindero npm maintainer account, which had publishing rights across the Mastra package environment. The attackers used that access to publish poisoned package versions that added a malicious dependency called easy-day-js.

Mastra npm Packages Were Poisoned Through a Fake dayjs Dependency

Mastra is an open-source TypeScript framework for building AI agents and AI-powered applications. Because it is used in developer environments, a compromise can expose secrets such as API keys, cloud credentials, npm tokens, GitHub tokens, and cryptocurrency wallet data.

The malicious package, easy-day-js, was designed as a typosquat of the popular dayjs JavaScript date library. Attackers first published a clean bait version, then released a weaponized version with a postinstall script that ran automatically during package installation.

According to StepSecurity, the affected Mastra packages had a combined weekly download count of more than 1.1 million. That made the campaign especially dangerous for automated development workflows that install dependencies without manual review.

How the Mastra npm Attack Worked

Stage	What happened	Why it mattered
Account compromise	The ehindero npm maintainer account was taken over.	The account had publish rights across the Mastra ecosystem.
Typosquat package	Attackers published easy-day-js to imitate dayjs.	The fake package looked familiar enough to avoid quick suspicion.
Mass package poisoning	More than 140 Mastra packages were republished with easy-day-js as a dependency.	Developers and CI/CD systems could pull the malicious dependency during normal installs.
Postinstall execution	The package ran setup.cjs during installation.	The malware executed even if developers never imported the package in application code.
Second-stage payload	The dropper contacted attacker infrastructure and launched a hidden Node.js payload.	The attackers gained a path to collect system data, secrets, and wallet-related information.

The public Mastra GitHub issue noted that [email protected] was published with easy-day-js as a new dependency and that the malicious postinstall script downloaded and executed code from attacker infrastructure.

The same issue flagged several warning signs. The affected package version was manually published rather than through the usual GitHub Actions pipeline, npm provenance was missing, and easy-day-js was not referenced in the real Mastra codebase.

Microsoft says the payload ran during installation, which means developer machines and CI/CD pipelines could have been exposed through a routine npm install or npm update. The risk did not depend on whether the package was later used by the application.

The Malware Targeted Secrets, Wallets, and Developer Systems

Once installed, easy-day-js launched an obfuscated dropper that disabled TLS certificate verification, contacted command-and-control infrastructure, downloaded a second-stage payload, and ran it as a detached hidden process.

The second-stage implant collected host details, installed applications, running processes, browser history, and cryptocurrency wallet browser extension data. Microsoft said it checked for 166 wallet extension IDs across Chrome, Edge, and Brave profiles.

The malware also used persistence methods across major operating systems. On Windows, it used a registry Run key. On macOS, it used a LaunchAgent. On Linux, it used a systemd user service. The file and service names were designed to look like normal Node.js tooling.

Why CI/CD Pipelines Were at Risk

CI/CD systems are attractive targets because they often hold deployment secrets, package publishing tokens, cloud credentials, and source code access. In this case, the malware ran during dependency installation, a step that many pipelines perform automatically.

For development teams, the biggest concern is not only a compromised local workstation. A poisoned package can also expose build servers and deployment systems, giving attackers a path toward downstream software tampering or wider credential theft.

Microsoft’s analysis also links the campaign to broader Sapphire Sleet tradecraft, including post-compromise activity and a separate npm supply chain compromise affecting Axios in April 2026.

Key Indicators From the Campaign

Type	Indicator	Purpose
npm package	easy-day-js	Malicious typosquat of dayjs
npm account	ehindero	Compromised Mastra package publisher
npm account	sergey2016	Publisher of easy-day-js
IP address	23.254.164[.]92	Primary command-and-control server
IP address	23.254.164[.]123	Secondary command-and-control address
Domain	teams[.]onweblive[.]org	PowerShell backdoor delivery domain
Domain	maskasd[.]com	Post-compromise beacon domain
File artifact	$TMPDIR/.pkg_history	Install path marker for compromised package activity
File artifact	$TMPDIR/.pkg_logs	Marker containing encoded easy-day-js data

StepSecurity’s timeline says the attacker used semantic versioning to widen the impact. The dependency was added as easy-day-js@^1.11.21, which allowed npm to resolve installs to the later malicious 1.11.22 version once it appeared on the registry.

The Mastra project remains a widely used AI development framework, and its official site describes support for agents, workflows, memory, observability, and deployment into Node.js-compatible environments. That developer focus made the ecosystem a high-value target for a supply chain attack.

The incident also shows why npm postinstall scripts remain risky. They can run automatically during normal package installation, which gives attackers an execution path before developers review or run the application itself.

What Developers and Security Teams Should Do

Teams that installed affected Mastra packages should review local developer systems, build runners, and package-lock files for easy-day-js. They should also look for unexpected JavaScript files in home or temporary directories and review CI/CD logs for suspicious postinstall execution.

Security teams should rotate credentials, tokens, API keys, and wallet-related secrets that were present on any potentially exposed system. This includes GitHub tokens, npm tokens, cloud credentials, LLM API keys, database credentials, and deployment secrets.

• Review dependency trees for affected Mastra and @mastra package versions.
• Search node_modules and lock files for easy-day-js.
• Pin known-good versions where possible.
• Use npm install with –ignore-scripts when postinstall scripts are not required.
• Rotate credentials and API keys from potentially exposed systems.
• Block known command-and-control IP addresses at the network perimeter.
• Audit CI/CD logs for unexpected outbound connections.
• Review developer workstations for persistence artifacts.

Sapphire Sleet Continues to Target the Software Supply Chain

Sapphire Sleet has a long history of financially motivated cyber activity tied to North Korea. The group has targeted cryptocurrency firms, developers, financial organizations, and software supply chains to steal credentials and crypto assets.

The GitHub disclosure thread also showed how quickly the community identified suspicious publishing behavior. That public reporting helped connect the unusual package changes, missing provenance, new dependency, and malicious setup script.

The incident adds to a growing list of attacks where trusted development tools became delivery mechanisms for malware. Developers should treat dependency installation as a security boundary, not just a build step.

StepSecurity’s research and Microsoft’s follow-up analysis both point to the same lesson: supply chain attacks can spread fast when attackers control a trusted maintainer account, especially inside ecosystems used by modern AI and cloud development teams.

For teams using Mastra, the immediate priority is to confirm whether affected versions were installed, rotate exposed secrets, and check both developer machines and automated build systems for signs of compromise.

FAQ