Summary
Microsoft has attributed a sweeping supply chain attack on the Mastra AI npm ecosystem to North Korea’s Sapphire Sleet group (also tracked as BlueNoroff/UNC1069). Over 140 packages within the @mastra/* scope — a popular open-source JavaScript and TypeScript framework for building AI applications — were poisoned after attackers compromised the npm account of a legitimate contributor around June 17, 2026.
The attackers published malicious updates injecting a typosquatted dependency called easy-day-js, designed to mimic the legitimate dayjs library. The obfuscated postinstall script deployed a cross-platform information stealer targeting LLM API keys, cloud provider credentials, database connection strings, CI/CD secrets, browser history, and cryptocurrency wallet data across Windows, Linux, and macOS. With the affected packages receiving over 1.1 million combined weekly downloads, the blast radius is enormous.
The malicious versions have been removed and the attacker’s publish access revoked, but any organization running @mastra packages updated after June 16 should treat their environments as potentially compromised.
Source
Microsoft Security Blog — Postinstall Payload Inside Mastra npm Supply Chain Compromise
BleepingComputer — Microsoft Links Mastra AI Supply Chain Attack to North Korean Hackers
The Hacker News — 144 Mastra npm Packages Compromised
Commentary
This is the second major npm supply chain attack attributed to North Korea’s UNC1069 cluster in 2026, following the Axios compromise in April. The pattern is clear: state-sponsored actors are specifically targeting AI developer tooling because that’s where the high-value secrets live — LLM API keys alone can be worth thousands of dollars on underground markets, and cloud credentials open the door to entire enterprise environments.
The attack surface here is terrifying. A single compromised contributor account turned a trusted AI framework into a credential harvesting pipeline hitting over a million installs per week. If your CI/CD pipelines pulled @mastra packages in the affected window, every secret those environments touched should be considered burned. This is a loud reminder that pinning dependencies, enforcing provenance checks, and running package audits are not optional — especially in the AI tooling space where developers routinely handle API keys with significant financial value.