Mastra npm Supply-Chain Compromise (@mastra/* namespace) via Typosquatted 'easy-day-js' — Multi-Stage Cross-Platform Infostealer
Mastra npm Supply-Chain Compromise (@mastra/* namespace) via (TL-2026-0834), also tracked as Mastra npm compromise, is a critical-severity supply-chain compromise, first published 2026-06-17. It is attributed to Lazarus Group (North Korea) with high confidence, affects Mastra @mastra/core (npm), maps to 26 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 30 indicators of compromise.
Key facts for TL-2026-0834
- Threat ID
- TL-2026-0834
- Also known as
- Mastra npm compromise, easy-day-js typosquat campaign, NvmProtocal infostealer
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-06-17
- Last reviewed
- 2026-06-17
- Attribution
- Lazarus Group
- Attribution confidence
- HIGH
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- technology, software development, AI/ML development, cryptocurrency, DevOps
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 30
The @mastra/* npm namespace was compromised on 2026-06-17, with 141+ malicious package versions (including @mastra/core, ~918K weekly downloads) republished by the npm account 'ehindero' over a ~30-minute scripted sweep. Each manifest gained a hidden dependency on the typosquatted 'easy-day-js' (a dayjs lookalike) whose postinstall hook drops a two-stage Node.js infostealer that harvests browser history and cryptocurrency-wallet artifacts, performs host reconnaissance, installs OS-specific persistence, and maintains C2 for arbitrary follow-on code execution.
How Mastra npm Supply-Chain Compromise (@mastra/* namespace) via works
On 2026-06-17 an attacker who had gained publish rights across the entire @mastra npm organization republished the catalog in a scripted sweep (Socket counted 141+ malicious versions published between 01:15 and 02:36 UTC; Endor Labs observed 116 packages / 32 of them in an initial 27-minute window without SLSA provenance). Combined reach of the affected packages exceeds 28 million downloads per month, with @mastra/core alone at ~918K weekly downloads. The compromise vector was a single added line in each package.json declaring a dependency on 'easy-day-js' (^1.11.21). easy-day-js is a typosquat of the ubiquitous 'dayjs' library: a clean decoy v1.11.21 was published 2026-06-16 (by account 'sergey2016' / ehindero2016@tutamail.com per Endor) to establish benign history, then the weaponized v1.11.22 was released 2026-06-17 ~01:01 UTC. The package impersonates dayjs down to its description and bundled dayjs.min.js but adds a postinstall hook ('node setup.cjs --no-warnings').
Stage 1 (setup.cjs, ~4.5 KB, obfuscated with obfuscator.io) disables TLS certificate validation (process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0'), writes victim marker/beacon files (.pkg_history, .pkg_logs) to the home/temp directory, beacons to the C2 at https://23.254.164.92:8000/update/49890878, fetches the second-stage payload to a randomized filename (e.g. a 24-hex .js file) in /tmp or the home directory, spawns it as a detached, hidden (detached:true, .unref(), stdio:'ignore', windowsHide:true) Node.js child process, and self-deletes via fs.rmSync(__filename, { force: true }) to limit forensic traces.
Stage 2 (protocal.cjs, ~41 KB) is a cross-platform Node.js tasking implant. It establishes OS-specific persistence: on Windows a HKCU CurrentVersion\Run value 'NvmProtocal' launching hidden PowerShell with the payload stored at C:\ProgramData\NodePackages\; on macOS a LaunchAgent ~/Library/LaunchAgents/com.nvm.protocal.plist (RunAtLoad) with payload at ~/Library/NodePackages/protocal.cjs; on Linux a systemd user unit ~/.config/systemd/user/nvmconf.service with payload at ~/.config/systemd/nvmconf/protocal.cjs. It inventories cryptocurrency wallets via 166 hardcoded browser-extension IDs (MetaMask, Phantom, Coinbase Wallet, Binance Wallet, TronLink, and others), copies and reads the History databases of Chrome, Edge, and Brave, and collects host reconnaissance (hostname, architecture, platform, user ID, installed applications, running processes). C2 is a custom ICAP-style tasking channel over HTTPS POST using a hardcoded legacy User-Agent ('mozilla/4.0 (compatible; msie 8.0; windows nt 5.1; trident/4.0)') and bot path /49890878, with a secondary endpoint at https://23.254.164.123:443/49890878. The implant supports a Node runner and a Shell runner, honors config updates and exit commands, and can deliver arbitrary follow-on code — making every affected developer host a remotely controllable foothold. No CVE was assigned; this is a package-registry account-takeover supply-chain event rather than a software vulnerability.
MITRE ATT&CK techniques used in TL-2026-0834
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1564 Hide Artifacts
Exfiltration
T1041 Exfiltration Over C2 Channel
Discovery
T1057 Process Discovery; T1082 System Information Discovery; T1087 Account Discovery; T1518 Software Discovery
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1571 Non-Standard Port
Initial Access
discovery
T1217 Browser Information Discovery
Persistence
T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution
Credential Access
T1555 Credentials from Password Stores
Resource Development
T1583 Acquire Infrastructure; T1585 Establish Accounts; T1586 Compromise Accounts; T1587 Develop Capabilities
defense-impairment
Affected products and versions in Mastra npm Supply-Chain Compromise (@mastra/* namespace) via
- Mastra — @mastra/core (npm)
Vulnerable versions: 1.42.1 (and all @mastra/core versions published 2026-06-17 without SLSA provenance)
Fixed in: clean versions republished with valid provenance after 2026-06-17 - Mastra — @mastra/schema-compat (npm)
Vulnerable versions: 1.2.12
Fixed in: post-incident clean republish - Mastra — mastra (npm)
Vulnerable versions: 1.13.1
Fixed in: post-incident clean republish - Mastra — @mastra/memory (npm)
Vulnerable versions: 1.20.4
Fixed in: post-incident clean republish - Mastra — @mastra/server (npm)
Vulnerable versions: 2.1.1
Fixed in: post-incident clean republish - Mastra (full namespace) — All @mastra/* and 'mastra' npm packages (141+ malicious versions)
Vulnerable versions: any version published 2026-06-17 without SLSA provenance
Fixed in: versions republished with valid provenance after the incident - easy-day-js (typosquat, attacker-controlled) — easy-day-js (npm)
Vulnerable versions: 1.11.22 (weaponized); 1.11.21 (clean decoy, attacker-controlled)
Fixed in: remove entirely; not a legitimate package
Remediation for Mastra npm Supply-Chain Compromise (@mastra/* namespace) via
Patches
- No vendor patch (registry account-takeover, not a code vulnerability); upgrade @mastra/* to known-clean versions republished with valid provenance after 2026-06-17
Immediate actions
- Pin/lockfile-audit all @mastra/* and 'mastra' dependencies; reject any version published 2026-06-17 lacking SLSA provenance and remove easy-day-js entirely
- Block C2 IPs 23.254.164.92 and 23.254.164.123 and the hostwindsdns.com hostnames at the perimeter; alert on traffic to AS54290 (Hostwinds)
- Hunt for and remove persistence: Windows HKCU Run value 'NvmProtocal', macOS LaunchAgent com.nvm.protocal.plist, Linux systemd unit nvmconf.service, and dropped protocal.cjs / NodePackages directories
- Treat any host that ran an affected install as compromised: rotate browser-stored credentials, crypto wallet seed phrases/keys, npm tokens, SSH keys and cloud secrets
Workarounds
- Disable npm lifecycle scripts globally (npm config set ignore-scripts true) until remediation is verified
- Quarantine and reimage developer hosts that executed the malicious postinstall
Longer-term hardening
- Enforce npm install with --ignore-scripts in CI and developer baselines to neutralize postinstall droppers
- Require provenance/SLSA attestation and 2FA-with-hardware-keys for all internal and dependency publishers
- Deploy EDR with behavioral detection for detached hidden Node child processes and TLS-validation tampering during package installs
- Adopt dependency-firewall / allowlist tooling and continuous supply-chain scanning (e.g. Socket) on the registry boundary
Weaknesses (CWE) in Mastra npm Supply-Chain Compromise (@mastra/* namespace) via
CWE-506, CWE-829, CWE-494, CWE-1357
Timeline of Mastra npm Supply-Chain Compromise (@mastra/* namespace) via
- A variant of the first-stage loader is first observed on public malware sandboxes, predating the namespace compromise.
- Clean decoy easy-day-js@1.11.21 published (Endor: 07:05 UTC by account sergey2016/ehindero2016@tutamail.com) to establish benign history before weaponization.
- Socket and Endor Labs publish technical analyses and IOCs; affected @mastra/* versions and easy-day-js flagged for removal and remediation.
- Cross-platform persistence artifacts catalogued: Windows Run key 'NvmProtocal' (HKCU CurrentVersion\Run) with payload in C:\ProgramData\NodePackages\; macOS LaunchAgent ~/Library/LaunchAgents/com.nvm.protocal.plist with RunAtLoad enabled; Linux systemd user unit ~/.config/systemd/user/nvmconf.service.
- Socket blocks installation of the malicious easy-day-js dependency within ~6 minutes of publication, preventing the postinstall infostealer (setup.cjs) from executing on protected developer and CI hosts.
- Socket detects the malicious easy-day-js dependency within ~6 minutes of publication, triggering analysis and disclosure.
- The @mastra npm catalog is republished in a scripted sweep: Socket counts 141+ malicious versions between 01:15-02:36 UTC by account 'ehindero'; Endor observed 116 packages, 32 of them in an initial 27-minute window, all lacking SLSA provenance.
- Weaponized easy-day-js@1.11.22 released (~01:01 UTC) with a postinstall hook ('node setup.cjs --no-warnings') that drops the multi-stage infostealer.
Sources cited for Mastra npm Supply-Chain Compromise (@mastra/* namespace) via
- Mastra npm Packages Compromised
- Mastra npm Org Compromised: Multiple Packages Trojanized to Drop a Remote Payload via easy-day-js
- Malicious NPM packages fetch infostealer for Windows, Linux, macOS
- 144 Mastra npm Packages Compromised via Hijacked Contributor Account
- @mastra/toolsets - npm Package Security Analysis
- MITRE ATT&CK T1195.002 — Compromise Software Supply Chain
Threats related to Mastra npm Supply-Chain Compromise (@mastra/* namespace) via
- Sapphire Sleet (DPRK) 'easy-day-js' Supply-Chain Compromise of 140+ Mastra npm Packages via Hijacked Maintainer Account
- Mastra npm Supply Chain Attack: 141 @mastra/* Packages Backdoored via easy-day-js Typosquat to Deploy Cross-Platform Infostealer/RAT
- Amazon: North Korea's Sapphire Sleet (Stardust Chollima/UNC1069) Compromises Axios, Debug, Chalk, and Typo-Crypto npm Packages in Supply-Chain Campaign
- Mastra NPM Packages Trojanized with Malicious Dependency Injection - 116 Packages Compromised
- AWS Security Hub Extended Supply Chain Security — Open Source Malware Defense at Cloud Scale
Detection coverage for TL-2026-0834
As of 2026-06-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0834 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-0834
4 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.