Mastra npm Supply Chain Attack: 141 @mastra/* Packages Backdoored via easy-day-js Typosquat to Deploy Cross-Platform Infostealer/RAT — Threadlinqs Intelligence
As of 2026-06-17, Mastra npm Supply Chain Attack: 141 @mastra/* Packages Backdoored via easy-day-js Typosquat to Deploy Cross-Platform Infostealer/RAT is a critical-severity supply chain threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 26 indicators of compromise.
Threat ID: TL-2026-0836 · Severity: CRITICAL · Status: ACTIVE · Category: SUPPLY_CHAIN
On 2026-06-17 an attacker used a hijacked former-contributor npm account (ehindero) to mass-republish 141+ @mastra/* packages (including @mastra/core, 918K weekly downloads, and mastra/create-mastra)
Microsoft Threat Intelligence and Socket independently disclosed a high-impact npm supply-chain compromise of the Mastra AI agent framework on 2026-06-17. The attacker leveraged the npm account 'ehindero', a legitimate former Mastra contributor whose scope (publish) access to the @mastra organization had never been revoked, to mass-publish malicious versions across the scope. In an automated 88-minute burst (01:12-02:39 UTC) 141+ (reported as high as 144) @mastra/* packages were republished, each with a single change: a new phantom dependency 'easy-day-js' pinned as '^1.11.21'. The most heavily downloaded affected package, @mastra/core, draws ~918,000 weekly downloads; combined affected weekly downloads exceeded ~1.1 million.
The malicious dependency was staged in advance by a separate npm identity, 'sergey2016' (sergey2016@tutamail.com). A clean decoy easy-day-js@1.11.21 was published 2026-06-16 07:05 UTC to seed the registry, and the weaponized easy-day-js@1.11.22 was published 2026-06-17 01:01 UTC, minutes before the scope-wide republish. easy-day-js is a typosquat clone of the popular dayjs date library.
Stage 1 (loader): easy-day-js@1.11.22 carried a postinstall hook 'node setup.cjs --no-warnings' that fires during npm install on developer machines, CI/CD runners, and build environments. setup.cjs (~4,572 bytes, obfuscated with obfuscator.io) sets NODE_TLS_REJECT_UNAUTHORIZED=0 to disable TLS certificate validation, writes campaign-tracking marker files (~/.pkg_history holding the install path and ~/.pkg_logs holding an XOR-encoded package name), fetches the Stage-2 payload from 23.254.164.92:8000/update/49890878, writes it to a temp file named with 24 hex characters (<tmpdir>/<24hex>.js), spawns it as a detached background process (stdio:'ignore', windowsHide:true), establishes a C2 connection to 23.254.164.123:443, and self-deletes to minimize forensic traces.
Stage 2 (implant): protocal.cjs is a ~41 KB cross-platform Node.js tasking client / RAT. It installs Node-themed persistence disguised as legitimate Node.js tooling: a Windows HKCU CurrentVersion\Run key named 'NvmProtocal', a macOS LaunchAgent 'com.nvm.protocal.plist', and a Linux systemd user unit 'nvmconf.service', dropping artifacts under a 'NodePackages' directory. It inventories 166 cryptocurrency wallet browser extensions (MetaMask, Phantom, Coinbase Wallet, Binance Wallet, TronLink and others), extracts Chrome/Edge/Brave browser history via SQLite, performs host reconnaissance (running processes, installed applications), exfiltrates over the C2 channel, and polls for arbitrary C2 commands and additional module deployment.
The campaign infrastructure (23.254.164.92, 23.254.164.123) is hosted on Hostwinds LLC (AS54290), with associated reverse-DNS hostnames hwsrv-1327786.hostwindsdns.com and hwsrv-1327785.hostwindsdns.com. Remediation: run 'npm ls easy-day-js' to identify exposure, roll back/pin to the safe mastra@1.13.0 release using lockfiles, treat any machine that installed an affected @mastra/* version since 2026-06-16 as compromised, remove cross-platform persistence artifacts, rotate all reachable credentials (npm/GitHub tokens, cloud keys, LLM API keys, CI/CD secrets), move crypto assets to fresh wallets on clean devices, and adopt 'npm install --ignore-scripts', enforced lockfiles, and package cooldown periods.
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494, CWE-1357, CWE-295
Target sectors: technology, software-development, cryptocurrency, ci-cd-pipelines, open-source
Target regions: Global
Detections & IOCs
As of 2026-07-26, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 26 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
4 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1583, T1586, T1608, T1195, T1078, T1059, T1204, T1547, T1543, T1543