Mastra npm Supply-Chain Compromise (@mastra/* namespace) via Typosquatted 'easy-day-js' — Multi-Stage Cross-Platform Infostealer — Threadlinqs Intelligence
As of 2026-07-02, Mastra npm Supply-Chain Compromise (@mastra/* namespace) via Typosquatted 'easy-day-js' — Multi-Stage Cross-Platform Infostealer is a critical-severity supply chain threat attributed to APT38 (North Korea), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 30 indicators of compromise.
Threat ID: TL-2026-0834 · Severity: CRITICAL · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: APT38 · North Korea · FINANCIAL
The @mastra/* npm namespace was compromised on 2026-06-17, with 141+ malicious package versions (including @mastra/core, ~918K weekly downloads) republished by the npm account 'ehindero' over a
On 2026-06-17 an attacker who had gained publish rights across the entire @mastra npm organization republished the catalog in a scripted sweep (Socket counted 141+ malicious versions published between 01:15 and 02:36 UTC; Endor Labs observed 116 packages / 32 of them in an initial 27-minute window without SLSA provenance). Combined reach of the affected packages exceeds 28 million downloads per month, with @mastra/core alone at ~918K weekly downloads. The compromise vector was a single added line in each package.json declaring a dependency on 'easy-day-js' (^1.11.21). easy-day-js is a typosquat of the ubiquitous 'dayjs' library: a clean decoy v1.11.21 was published 2026-06-16 (by account 'sergey2016' / ehindero2016@tutamail.com per Endor) to establish benign history, then the weaponized v1.11.22 was released 2026-06-17 ~01:01 UTC. The package impersonates dayjs down to its description and bundled dayjs.min.js but adds a postinstall hook ('node setup.cjs --no-warnings').
Stage 1 (setup.cjs, ~4.5 KB, obfuscated with obfuscator.io) disables TLS certificate validation (process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0'), writes victim marker/beacon files (.pkg_history, .pkg_logs) to the home/temp directory, beacons to the C2 at https://23.254.164.92:8000/update/49890878, fetches the second-stage payload to a randomized filename (e.g. a 24-hex .js file) in /tmp or the home directory, spawns it as a detached, hidden (detached:true, .unref(), stdio:'ignore', windowsHide:true) Node.js child process, and self-deletes via fs.rmSync(__filename, { force: true }) to limit forensic traces.
Stage 2 (protocal.cjs, ~41 KB) is a cross-platform Node.js tasking implant. It establishes OS-specific persistence: on Windows a HKCU CurrentVersion\Run value 'NvmProtocal' launching hidden PowerShell with the payload stored at C:\ProgramData\NodePackages\; on macOS a LaunchAgent ~/Library/LaunchAgents/com.nvm.protocal.plist (RunAtLoad) with payload at ~/Library/NodePackages/protocal.cjs; on Linux a systemd user unit ~/.config/systemd/user/nvmconf.service with payload at ~/.config/systemd/nvmconf/protocal.cjs. It inventories cryptocurrency wallets via 166 hardcoded browser-extension IDs (MetaMask, Phantom, Coinbase Wallet, Binance Wallet, TronLink, and others), copies and reads the History databases of Chrome, Edge, and Brave, and collects host reconnaissance (hostname, architecture, platform, user ID, installed applications, running processes). C2 is a custom ICAP-style tasking channel over HTTPS POST using a hardcoded legacy User-Agent ('mozilla/4.0 (compatible; msie 8.0; windows nt 5.1; trident/4.0)') and bot path /49890878, with a secondary endpoint at https://23.254.164.123:443/49890878. The implant supports a Node runner and a Shell runner, honors config updates and exit commands, and can deliver arbitrary follow-on code — making every affected developer host a remotely controllable foothold. No CVE was assigned; this is a package-registry account-takeover supply-chain event rather than a software vulnerability.
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494, CWE-1357
Target sectors: technology, software development, AI/ML development, cryptocurrency, DevOps
Target regions: Global
Detections & IOCs
As of 2026-07-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 30 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
4 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1587, T1585, T1586, T1583, T1195, T1059, T1059, T1204, T1547, T1543