145 Mastra npm Packages Compromised in Supply Chain Attack, Crypto-Stealer Deployed

On June 17, 2026, a software supply chain attack codenamed ‘easy-day-js’ compromised 145 npm packages under the @mastra/* namespace, a popular open-source framework for building AI applications. The attack was discovered by multiple security firms including Endor Labs, JFrog, OX Security, SafeDep, Socket, StepSecurity, and Synk.

The attackers hijacked the npm account ‘ehindero’, a legitimate former Mastra contributor whose scope access was never revoked. They mass-published malicious package versions within an 88-minute window. The infected packages themselves did not contain malicious code; instead, they added a dependency on a third-party library named ‘easy-day-js’, a clone of the legitimate ‘dayjs’ date library.

The ‘easy-day-js’ package, published by user ‘sergey2016’, initially appeared clean but later introduced an obfuscated payload that executed during npm installation via a postinstall hook. This payload acted as a dropper, downloading a second-stage cross-platform information stealer from attacker-controlled infrastructure (IPs 23.254.164.92 and 23.254.164.123). The malware harvested browser history, stole data from over 160 cryptocurrency wallet browser extensions, installed persistence across Windows, macOS, and Linux, and exfiltrated data to a command-and-control server. It also polled the C2 server for commands, including downloading and executing additional modules.

Mastra confirmed the incident, stating that a current employee’s machine was compromised via a social engineering attack through LinkedIn. The company has since removed token bypass and unpublished malicious versions. Microsoft attributed the campaign to Sapphire Sleet, a North Korean hacking group also linked to the April 2026 Axios npm compromise. The attack pattern—compromising a maintainer, inserting a malicious transitive dependency, and using an install-time dropper—closely mirrors the Axios incident.

Any system that installed affected versions should be treated as compromised. Recommended actions include rolling back to safe versions, rotating credentials, and auditing for artifacts. The attack highlights the risks of unrevoked access and the need for signature-verifying installs and provenance attestations.