{"id":13778,"date":"2026-06-22T10:03:54","date_gmt":"2026-06-22T10:03:54","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/06\/22\/north-korean-hackers-abuse-mastra-npm-supply-chain-to-target-developers-and-ci-cd-pipelines\/"},"modified":"2026-06-22T10:03:54","modified_gmt":"2026-06-22T10:03:54","slug":"north-korean-hackers-abuse-mastra-npm-supply-chain-to-target-developers-and-ci-cd-pipelines","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/06\/22\/north-korean-hackers-abuse-mastra-npm-supply-chain-to-target-developers-and-ci-cd-pipelines\/","title":{"rendered":"North Korean Hackers Abuse Mastra npm Supply Chain to Target Developers and CI\/CD Pipelines"},"content":{"rendered":"

North Korean Hackers Abuse Mastra npm Supply Chain to Target Developers and CI\/CD Pipelines
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

North Korean hackers have turned a widely used developer tool into a weapon, quietly poisoning more than 140 software packages that developers across the world rely on every day. <\/p>\n

The campaign is sophisticated, stealthy, and far-reaching, raising urgent questions about the safety of the open-source supply chain.<\/a><\/p>\n

The attack targeted the Mastra ecosystem on the npm registry, a package manager used by millions of developers to build JavaScript applications. <\/p>\n

The threat actor gained access to a legitimate account and pushed malicious code into over 140 packages at once, meaning any developer or automated build system that ran a standard install command was potentially exposed without any warning.<\/a><\/p>\n

Analysts at\u00a0Microsoft\u00a0said in a report<\/a> shared with Cyber Security News (CSN) that they identified the compromise through unusual publishing patterns on the Mastra package. <\/p>\n

The team traced the intrusion back to Sapphire Sleet, a North Korean state-sponsored group known for targeting the finance and cryptocurrency sectors since at least March 2020.<\/a><\/p>\n

The attack began with the takeover of the ehindero npm maintainer account, which held publish rights across the entire Mastra package scope. <\/p>\n

The attacker then introduced a fake package called easy-day-js, built to impersonate the popular dayjs library<\/a> that sees over 57 million downloads each week. <\/p>\n

From there, every compromised Mastra package was updated to pull in easy-day-js as a new dependency, expanding the attack\u2019s reach instantly.<\/p>\n

\n
\"End-to-end
End-to-end attack chain (Source \u2013 Microsoft)<\/figcaption><\/figure>\n<\/div>\n

What made this especially dangerous is that the malicious code ran automatically the moment a developer installed any affected package, even if they never directly used it in their own application code. <\/p>\n

That single design choice put developer workstations, build servers, and automated CI\/CD pipelines all at risk at the same time.<\/a><\/p>\n

North Korean Hackers Abuse Mastra npm Supply Chain<\/strong><\/h2>\n

The attack followed a clever two-phase delivery strategy. First, a clean version of easy-day-js was published to establish the package as legitimate on the registry. <\/p>\n

The next day, a weaponized version was released that added a hidden postinstall hook, a script that fires automatically whenever the package is installed.<\/a><\/p>\n

That hook executed an obfuscated dropper script<\/a>, bypassed standard security certificate checks, and reached out to attacker-controlled servers to fetch a second-stage payload. <\/p>\n

The payload was then launched as a silent background process, making it hard to spot during a normal development session. The second-stage implant was a fully featured tasking client capable of running arbitrary commands sent by the attackers at any time.<\/p>\n

\n
\"The
The obfuscated setup.cjs dropper (Source \u2013 Microsoft)<\/figcaption><\/figure>\n<\/div>\n

On Windows systems, the implant went further by injecting code directly into memory without writing files to disk, a technique that helps it evade many traditional security tools. <\/p>\n

It collected installed applications, browser extensions tied to cryptocurrency wallets, and browsing history before sending everything back to the attackers. <\/p>\n

Sapphire Sleet then delivered a separate PowerShell backdoor on high-value targets, granting persistent and elevated access to compromised machines.<\/a><\/p>\n

Persistence, Exfiltration, and Defense Evasion<\/strong><\/h2>\n

Once inside a system, the implant made itself hard to remove by installing persistence across all three major operating systems. <\/p>\n

On Windows it used a registry Run key, on macOS a LaunchAgent, and on Linux a systemd service, all disguised under names that mimic legitimate Node.js tools to blend into a developer\u2019s normal environment.<\/a><\/p>\n

The backdoor added a Microsoft Defender exclusion to suppress detection and registered a service that loads a malicious file on every system boot. <\/p>\n

It also set up a persistence loader that fetches fresh payloads from the attackers on every login, letting them silently swap out code without touching the endpoint. <\/p>\n

Collected data was sent back using a spoofed legacy browser identity to avoid triggering network-based security alerts<\/a>.<\/a><\/p>\n

Microsoft recommends that developers review their dependency trees for any affected Mastra packages and check for easy-day-js in their project files. <\/p>\n

Running npm install with the \u2013ignore-scripts flag prevents postinstall hooks from running automatically. Teams should also rotate credentials or API keys present on potentially exposed systems and block the attacker-controlled IP addresses at the network perimeter.<\/a><\/p>\n

Indicators of Compromise (IoCs):-<\/strong><\/p>\n

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Type<\/th>\nIndicator<\/th>\nDescription<\/th>\n<\/tr>\n<\/thead>\n
IP Address<\/td>\n23.254.164.92<\/td>\nPrimary C2 server<\/td>\n<\/tr>\n
IP Address<\/td>\n23.254.164.123<\/td>\nSecondary C2 address (from deobfuscated strings)<\/td>\n<\/tr>\n
URL<\/td>\nhttps[:]\/\/23[.]254[.]164[.]92:8000\/update\/49890878<\/td>\nPayload download endpoint<\/td>\n<\/tr>\n
Domain<\/td>\nteams[.]onweblive[.]org<\/td>\nPost-compromise PowerShell backdoor delivery domain<\/td>\n<\/tr>\n
URL<\/td>\nhttps[:]\/\/teams[.]onweblive[.]org\/api\/update\/8555575039\/4<\/td>\nPost-compromise PowerShell backdoor download endpoint<\/td>\n<\/tr>\n
Domain<\/td>\nmaskasd[.]com<\/td>\nPost-compromise C2 beacon domain<\/td>\n<\/tr>\n
URL<\/td>\nhttps[:]\/\/maskasd[.]com\/8555575039<\/td>\nPost-compromise C2 beacon endpoint<\/td>\n<\/tr>\n
SHA-256<\/td>\nB122A9873BEDF145AE2A7FD024B5F309007DBB025149F4DC4AC3F7E4F32A36A4<\/td>\nsetup.cjs (malicious postinstall dropper)<\/td>\n<\/tr>\n
SHA-256<\/td>\nAE70DD4F6BC0D1C8C2848E4E6B51934626C4818DCB5AF99D080DDBD7DC337185<\/td>\neasy-day-js-1.11.22.tgz (weaponized tarball)<\/td>\n<\/tr>\n
SHA-256<\/td>\n4A8860240E4231C3A74C81949BE655A28E096A7D72F38FBE84E5B37636B98417<\/td>\neasy-day-js-1.11.21.tgz (clean bait tarball)<\/td>\n<\/tr>\n
SHA-256<\/td>\nB73DE25C053C3225A077738A1FCBD9CA6966D7B3CD6F5494A30F0AA0EAE55C7E<\/td>\nmastra-1.13.1.tgz (compromised CLI tarball)<\/td>\n<\/tr>\n
SHA-256<\/td>\n221c45a790dec2a296af57969e1165a16f8f49733aeab64c0bbd768d9943badf<\/td>\nprotocol.cjs<\/td>\n<\/tr>\n
SHA-256<\/td>\n50eae63d3e24be9ca8803f4b5a0408aef97ee3fab7af018d8c2dde7c359edd65<\/td>\nDownloader and backdoor PowerShell script<\/td>\n<\/tr>\n
SHA-256<\/td>\n1d1bf5e8c1539d2f05b1429235b8f4990f87036774be95157b315a7803dd5526<\/td>\nSecond-stage PowerShell script<\/td>\n<\/tr>\n
File Artifact<\/td>\n$TMPDIR\/.pkg_history<\/td>\nContains the install path of the compromised package<\/td>\n<\/tr>\n
File Artifact<\/td>\n$TMPDIR\/.pkg_logs<\/td>\nContains XOR 0x80 encoded string \u201ceasy-day-js\u201d<\/td>\n<\/tr>\n
File Artifact<\/td>\n<homedir>\/<random_hex>.js<\/td>\nDownloaded second-stage payload<\/td>\n<\/tr>\n
npm Package<\/td>\neasy-day-js<\/td>\nMalicious typosquat of dayjs<\/td>\n<\/tr>\n
npm Account<\/td>\nsergey2016<\/td>\nPublisher of easy-day-js<\/td>\n<\/tr>\n
npm Account<\/td>\nehindero<\/td>\nCompromised publisher of 140+ Mastra packages<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

Note:<\/strong>\u00a0IP addresses and domains are intentionally defanged (e.g.,\u00a0<\/em>[.]<\/em><\/code>) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM<\/em>.<\/p>\n

Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in<\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong> Google<\/a><\/strong><\/strong>.<\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/p>\n

The post North Korean Hackers Abuse Mastra npm Supply Chain to Target Developers and CI\/CD Pipelines<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

North Korean Hackers Abuse Mastra npm Supply Chain to Target Developers and CI\/CD Pipelines North Korean hackers have turned a widely used developer tool into a weapon, quietly poisoning more than 140 software packages that developers across the world rely on every day. The campaign is sophisticated, stealthy, and far-reaching, raising urgent questions about the […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-13778","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/13778"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=13778"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/13778\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=13778"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=13778"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=13778"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}