Mastra npm attack: 140+ packages backdoored

What happened

On June 17, 2026, one of the most popular open-source frameworks for building AI agents — Mastra (TypeScript) — fell victim to a supply chain attack. Attackers took control of the npm account ehindero, which had publish rights across the entire @mastra scope. The first analyses (Snyk) described it as a dormant account belonging to a former Mastra contributor whose publish rights were never revoked; later reporting citing the incident report offered a different version — that the account belongs to an active maintainer who was compromised via social engineering (a LinkedIn message, a call, a click on a suspicious link). Either way, through that account the attackers republished more than 140 packages in under an hour and a half (per StepSecurity, a window of roughly 01:12 to 02:39 UTC, about 87 minutes).

Each package gained one "innocuous" dependency — easy-day-js, a typosquat of the legitimate date library dayjs (the original gets 57M+ downloads a week). The fake posed as dayjs: it copied the version numbering, the author name (iamkun) and the repository link — even though it was published from an unrelated account (sergey2016@tutamail.com).

From there it was classic npm malware. On an ordinary npm install, a postinstall hook fired and launched an obfuscated dropper (4,572 bytes, per Microsoft's analysis). It disabled TLS certificate validation (NODE_TLS_REJECT_UNAUTHORIZED=0), called out to the attackers' C2 server, downloaded a second stage (a Node.js implant), ran it as a separate hidden process and deleted itself to cover its tracks.

The main goal was money. The implant checked a hardcoded list of 166 browser extension IDs for crypto wallets (MetaMask, Phantom, Coinbase Wallet, Binance Wallet, TronLink and others), scraped browser data (Chrome, Edge, Brave) and, along the way, environment variables — meaning the LLM keys and cloud credentials that Mastra projects tend to have plenty of.

Microsoft attributed the attack with high confidence to the North Korean group Sapphire Sleet (also known as BlueNoroff, UNC1069, STARDUST CHOLLIMA, Alluring Pisces, CageyChameleon, CryptoCore), a financially motivated actor specializing in cryptocurrency theft.

A note on the numbers: different outlets counted between 141 and 145 packages; Microsoft's report uses the phrasing "140+." The exact figure depends on the counting method.

Why it matters

This is not "yet another malicious npm package" but a landmark case for several reasons at once:

• It hit AI agent infrastructure. Mastra is no niche library: the affected packages together see more than 1.1 million downloads a week, by StepSecurity's estimate. Developers who never opened anyone's malicious website got hit — they simply updated their dependencies.
• The hole was in access rights, not in the code. What was compromised was not the project but a maintainer account with publish rights across the whole scope. Whether it was a former contributor's forgotten access or an active maintainer's socially engineered account, the conclusion is the same: one such account = compromise of an entire package ecosystem.
• postinstall still works. The script runs automatically at install time, before you execute a single line of your own code. For CI/CD and local machines that is instant RCE.
• North Korean groups target developers specifically. Sapphire Sleet/BlueNoroff have long hunted crypto and work through social engineering against engineers (the same group has featured in other supply chain incidents). A developer with a crypto wallet in the browser is an ideal target.

What it means for vibe coding

Vibe coding runs on trust: the agent suggests installing a package or an MCP server, and it gets installed without a second look. This incident is a direct reminder that installing someone else's code means executing someone else's code.

Practical takeaways:

• If you installed or updated anything from @mastra on June 17, treat your environment as compromised. Rotate LLM and cloud keys, check and where possible recreate crypto wallets, and scrub easy-day-js from your dependencies and lock file.
• Disable install scripts by default. npm install --ignore-scripts (or the corresponding .npmrc setting) removes the main vector for postinstall malware. Individual packages that genuinely need scripts can be allowed case by case.
• Do not run npm install as the same user that holds your wallets and production secrets. Install dependencies in an isolated environment or container, not on the machine with MetaMask in the browser.
• Pin versions and watch fresh releases. A mass republish of an entire scope within an hour is an anomaly that tools like Socket, StepSecurity and Snyk catch. A fresh package != a safe package.
• The same principle applies to MCP servers and agent tooling. You often install those through npm/pip on an AI's advice too. Check the publisher and do not hand them access to secrets without need.

In short: the convenience of "install it and forget it" is exactly what this kind of attack is built on. A little paranoia at install time is cheaper than a drained wallet.

Sources

• Microsoft Security Blog — Inside the Mastra npm supply chain compromise by Sapphire Sleet (primary source, 17.06.2026)
• The Hacker News — 145 Mastra npm Packages Compromised via Hijacked Contributor Account
• StepSecurity — Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat
• Snyk — A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope
• BleepingComputer — Microsoft links Mastra AI supply chain attack to North Korean hackers