North Korean Hackers Blamed for Mastra NPM Supply Chain Attack
The North Korean state-sponsored threat actor Sapphire Sleet is behind the Mastra supply chain attack that hit over 140 NPM packages last week, Microsoft reports.
Mastra is an open source TypeScript framework for building AI agents, workflows, and RAG pipelines. It offers integrations for major LLM providers, MCP servers, and cloud deployments.
The supply chain attack occurred on June 17. During a 45-minute window, the hackers published 141 packages that contained the malicious dependency easy-day-js, a typosquat of the legitimate dayjs date library.
The affected Mastra packages have approximately 8 million weekly downloads. All users who installed a @mastra package during the attack window on June 17 should consider their systems affected.
As part of the attack, the hackers compromised the ‘ehindero’ NPM maintainer account, which has publishing rights across the Mastra ecosystem. One day before the account takeover, the attackers published a clean version of easy-day-js to a...
Copyright of this story solely belongs to securityweek.com. To see the full text click HERE
