# Mastra npm Supply-Chain Compromise (@mastra/* namespace) via Typosquatted 'easy-day-js' — Multi-Stage Cross-Platform Infostealer

> The @mastra/* npm namespace was compromised on 2026-06-17, with 141+ malicious package versions (including @mastra/core, ~918K weekly downloads) republished by the npm account 'ehindero' over a ~30-minute scripted sweep. Each manifest gained a hidden dependency on the typosquatted 'easy-day-js' (a dayjs lookalike) whose postinstall hook drops a two-stage Node.js infostealer that harvests browser history and cryptocurrency-wallet artifacts, performs host reconnaissance, installs OS-specific persistence, and maintains C2 for arbitrary follow-on code execution.

- **Published:** 2026-06-17T00:00:00Z
- **Last reviewed:** 2026-06-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0834
- **ID:** TL-2026-0834
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** Lazarus Group (North Korea)
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-06-17 an attacker who had gained publish rights across the entire @mastra npm organization republished the catalog in a scripted sweep (Socket counted 141+ malicious versions published between 01:15 and 02:36 UTC; Endor Labs observed 116 packages / 32 of them in an initial 27-minute window without SLSA provenance). Combined reach of the affected packages exceeds 28 million downloads per month, with @mastra/core alone at ~918K weekly downloads. The compromise vector was a single added line in each package.json declaring a dependency on 'easy-day-js' (^1.11.21). easy-day-js is a typosquat of the ubiquitous 'dayjs' library: a clean decoy v1.11.21 was published 2026-06-16 (by account 'sergey2016' / ehindero2016@tutamail.com per Endor) to establish benign history, then the weaponized v1.11.22 was released 2026-06-17 ~01:01 UTC. The package impersonates dayjs down to its description and bundled dayjs.min.js but adds a postinstall hook ('node setup.cjs --no-warnings').

Stage 1 (setup.cjs, ~4.5 KB, obfuscated with obfuscator.io) disables TLS certificate validation (process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0'), writes victim marker/beacon files (.pkg_history, .pkg_logs) to the home/temp directory, beacons to the C2 at https://23.254.164.92:8000/update/49890878, fetches the second-stage payload to a randomized filename (e.g. a 24-hex .js file) in /tmp or the home directory, spawns it as a detached, hidden (detached:true, .unref(), stdio:'ignore', windowsHide:true) Node.js child process, and self-deletes via fs.rmSync(__filename, { force: true }) to limit forensic traces.

Stage 2 (protocal.cjs, ~41 KB) is a cross-platform Node.js tasking implant. It establishes OS-specific persistence: on Windows a HKCU CurrentVersion\Run value 'NvmProtocal' launching hidden PowerShell with the payload stored at C:\ProgramData\NodePackages\; on macOS a LaunchAgent ~/Library/LaunchAgents/com.nvm.protocal.plist (RunAtLoad) with payload at ~/Library/NodePackages/protocal.cjs; on Linux a systemd user unit ~/.config/systemd/user/nvmconf.service with payload at ~/.config/systemd/nvmconf/protocal.cjs. It inventories cryptocurrency wallets via 166 hardcoded browser-extension IDs (MetaMask, Phantom, Coinbase Wallet, Binance Wallet, TronLink, and others), copies and reads the History databases of Chrome, Edge, and Brave, and collects host reconnaissance (hostname, architecture, platform, user ID, installed applications, running processes). C2 is a custom ICAP-style tasking channel over HTTPS POST using a hardcoded legacy User-Agent ('mozilla/4.0 (compatible; msie 8.0; windows nt 5.1; trident/4.0)') and bot path /49890878, with a secondary endpoint at https://23.254.164.123:443/49890878. The implant supports a Node runner and a Shell runner, honors config updates and exit commands, and can deliver arbitrary follow-on code — making every affected developer host a remotely controllable foothold. No CVE was assigned; this is a package-registry account-takeover supply-chain event rather than a software vulnerability.

## MITRE ATT&CK

- T1587 Develop Capabilities
- T1585 Establish Accounts
- T1586 Compromise Accounts
- T1583 Acquire Infrastructure
- T1195 Supply Chain Compromise
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1547 Boot or Logon Autostart Execution
- T1543 Create or Modify System Process
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1070 Indicator Removal
- T1036 Masquerading
- T1564 Hide Artifacts
- T1685 Disable or Modify Tools
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1057 Process Discovery
- T1518 Software Discovery
- T1087 Account Discovery
- T1005 Data from Local System
- T1217 Browser Information Discovery
- T1071 Application Layer Protocol
- T1571 Non-Standard Port
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Sources

- [Mastra npm Packages Compromised](https://socket.dev/blog/mastra-npm-packages-compromised)
- [Mastra npm Org Compromised: Multiple Packages Trojanized to Drop a Remote Payload via easy-day-js](https://www.endorlabs.com/learn/mastra-npm-org-compromised-multiple-packages-trojanized-to-drop-a-remote-payload-via-easy-day-js)
- [Malicious NPM packages fetch infostealer for Windows, Linux, macOS](https://www.bleepingcomputer.com/news/security/malicious-npm-packages-fetch-infostealer-for-windows-linux-macos/)
- [144 Mastra npm Packages Compromised via Hijacked Contributor Account](https://forum.ksec.co.uk/t/144-mastra-npm-packages-compromised-via-hijacked-contributor-account/15763)
- [@mastra/toolsets - npm Package Security Analysis](https://socket.dev/npm/package/@mastra/toolsets)
- [MITRE ATT&CK T1195.002 — Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0834