North Korean Sapphire Sleet Behind Mastra AI npm Supply Chain Attack
Microsoft has attributed the recent Mastra AI supply chain attack—which compromised more than 140 npm packages—to Sapphire Sleet, a North Korean state-sponsored threat group also tracked as BlueNoroff. The campaign began when attackers hijacked the npm maintainer account "ehindero," which held publishing privileges across the Mastra package environment, and pushed malicious updates injecting a typosquatted dependency named "easy-day-js" that mimicked the widely used dayjs JavaScript library. Microsoft assesses with high confidence that the activity is tied to Sapphire Sleet, a financially motivated actor known for targeting the financial and cryptocurrency sectors.
Once installed, the compromised packages triggered a postinstall hook executing an obfuscated dropper that disabled Transport Layer Security (TLS) certificate verification, contacted attacker-controlled command-and-control infrastructure, and deployed a second-stage payload as a detached hidden process. This cross-platform information stealer targeted Windows, Linux, and macOS systems, harvesting host information, browser histories, installed applications, running processes, and credentials from 166 cryptocurrency wallet browser extensions including MetaMask, Phantom, Coinbase Wallet, Binance Wallet, and TronLink. Persistence was established through platform-specific mechanisms: Windows Registry Run keys, macOS LaunchAgents, and Linux systemd services.
Follow-on activity observed on systems communicating with the C2 servers included a PowerShell backdoor previously linked to Sapphire Sleet, additional persistence mechanisms, Microsoft Defender exclusions, and a malicious Windows service granting SYSTEM-level privileges. The reuse of the PowerShell backdoor, tradecraft patterns, and C2 infrastructure from prior Sapphire Sleet campaigns provided the attribution evidence. Organizations and developers who installed packages from the @mastra scope during the compromise window are urged to rotate credentials, API keys, and authentication tokens, audit their npm dependencies, and verify the integrity of their build environments.
Given the credential-stealing focus of this campaign, security teams should immediately audit developer accounts and wallets for exposure. Use our password checker to verify whether any stored developer credentials have appeared in known breaches, and run our email breach checker to confirm whether developer or CI/CD account emails were compromised. Teams should also inspect certificate handling on build hosts, since the malware disabled TLS verification to intercept traffic—our SSL/TLS checker can help validate proper certificate chain validation across your infrastructure.