Mastra npm Supply Chain Attack: 141 @mastra/* Packages Backdoored via easy-day-js Typosquat to Deploy Cross-Platform Infostealer/RAT
Mastra npm Supply Chain Attack (TL-2026-0836), also tracked as Mastra npm Scope Takeover, is a critical-severity supply-chain compromise, first published 2026-06-17. It has no confirmed attribution, affects Mastra @mastra/* npm scope (Mastra AI agent framework), maps to 22 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 26 indicators of compromise.
Key facts for TL-2026-0836
- Threat ID
- TL-2026-0836
- Also known as
- Mastra npm Scope Takeover, easy-day-js typosquat campaign
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-06-17
- Last reviewed
- 2026-06-17
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, cryptocurrency, ci-cd-pipelines, open-source
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in Mastra npm Supply Chain Attack
Malware and tooling: protocal.cjs cross-platform Node.js infostealer/RAT
On 2026-06-17 an attacker used a hijacked former-contributor npm account (ehindero) to mass-republish 141+ @mastra/* packages (including @mastra/core, 918K weekly downloads, and mastra/create-mastra) with a single injected dependency: easy-day-js, a dayjs typosquat. easy-day-js@1.11.22 ran an obfuscated postinstall loader (setup.cjs) that disabled TLS verification, downloaded a second-stage cross-platform Node.js infostealer/RAT (protocal.cjs), and self-deleted. The implant inventories 160+ crypto wallet extensions, steals browser history, installs Node-themed persistence on Windows/macOS/Linux, and beacons to live C2 23.254.164.123:443.
How Mastra npm Supply Chain Attack works
Microsoft Threat Intelligence and Socket independently disclosed a high-impact npm supply-chain compromise of the Mastra AI agent framework on 2026-06-17. The attacker leveraged the npm account 'ehindero', a legitimate former Mastra contributor whose scope (publish) access to the @mastra organization had never been revoked, to mass-publish malicious versions across the scope. In an automated 88-minute burst (01:12-02:39 UTC) 141+ (reported as high as 144) @mastra/* packages were republished, each with a single change: a new phantom dependency 'easy-day-js' pinned as '^1.11.21'. The most heavily downloaded affected package, @mastra/core, draws ~918,000 weekly downloads; combined affected weekly downloads exceeded ~1.1 million.
The malicious dependency was staged in advance by a separate npm identity, 'sergey2016' (sergey2016@tutamail.com). A clean decoy easy-day-js@1.11.21 was published 2026-06-16 07:05 UTC to seed the registry, and the weaponized easy-day-js@1.11.22 was published 2026-06-17 01:01 UTC, minutes before the scope-wide republish. easy-day-js is a typosquat clone of the popular dayjs date library.
Stage 1 (loader): easy-day-js@1.11.22 carried a postinstall hook 'node setup.cjs --no-warnings' that fires during npm install on developer machines, CI/CD runners, and build environments. setup.cjs (~4,572 bytes, obfuscated with obfuscator.io) sets NODE_TLS_REJECT_UNAUTHORIZED=0 to disable TLS certificate validation, writes campaign-tracking marker files (~/.pkg_history holding the install path and ~/.pkg_logs holding an XOR-encoded package name), fetches the Stage-2 payload from 23.254.164.92:8000/update/49890878, writes it to a temp file named with 24 hex characters (<tmpdir>/<24hex>.js), spawns it as a detached background process (stdio:'ignore', windowsHide:true), establishes a C2 connection to 23.254.164.123:443, and self-deletes to minimize forensic traces.
Stage 2 (implant): protocal.cjs is a ~41 KB cross-platform Node.js tasking client / RAT. It installs Node-themed persistence disguised as legitimate Node.js tooling: a Windows HKCU CurrentVersion\Run key named 'NvmProtocal', a macOS LaunchAgent 'com.nvm.protocal.plist', and a Linux systemd user unit 'nvmconf.service', dropping artifacts under a 'NodePackages' directory. It inventories 166 cryptocurrency wallet browser extensions (MetaMask, Phantom, Coinbase Wallet, Binance Wallet, TronLink and others), extracts Chrome/Edge/Brave browser history via SQLite, performs host reconnaissance (running processes, installed applications), exfiltrates over the C2 channel, and polls for arbitrary C2 commands and additional module deployment.
The campaign infrastructure (23.254.164.92, 23.254.164.123) is hosted on Hostwinds LLC (AS54290), with associated reverse-DNS hostnames hwsrv-1327786.hostwindsdns.com and hwsrv-1327785.hostwindsdns.com. Remediation: run 'npm ls easy-day-js' to identify exposure, roll back/pin to the safe mastra@1.13.0 release using lockfiles, treat any machine that installed an affected @mastra/* version since 2026-06-16 as compromised, remove cross-platform persistence artifacts, rotate all reachable credentials (npm/GitHub tokens, cloud keys, LLM API keys, CI/CD secrets), move crypto assets to fresh wallets on clean devices, and adopt 'npm install --ignore-scripts', enforced lockfiles, and package cooldown periods.
MITRE ATT&CK techniques used in TL-2026-0836
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal
Exfiltration
T1041 Exfiltration Over C2 Channel
Discovery
T1057 Process Discovery; T1518 Software Discovery
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1573 Encrypted Channel
Initial Access
T1078 Valid Accounts; T1195 Supply Chain Compromise
Credential Access
T1539 Steal Web Session Cookie; T1552 Unsecured Credentials
Persistence
T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution
Resource Development
T1583 Acquire Infrastructure; T1586 Compromise Accounts; T1608 Stage Capabilities
defense-impairment
Affected products and versions in Mastra npm Supply Chain Attack
- Mastra — @mastra/* npm scope (Mastra AI agent framework)
Vulnerable versions: @mastra/core, mastra, create-mastra and 138+ other @mastra/* packages republished 2026-06-17 01:12-02:39 UTC
Fixed in: mastra@1.13.0 - sergey2016 (attacker) — easy-day-js (npm, dayjs typosquat)
Vulnerable versions: 1.11.22
Fixed in: remove dependency; use legitimate dayjs
Remediation for Mastra npm Supply Chain Attack
Patches
- Pin/roll back to mastra@1.13.0 (pre-incident safe release) via lockfiles
Immediate actions
- Run 'npm ls easy-day-js' across all projects, lockfiles, and CI to identify exposure
- Treat any host that installed an affected @mastra/* version since 2026-06-16 as fully compromised
- Block outbound traffic to 23.254.164.92 and 23.254.164.123 (Hostwinds AS54290) at the perimeter
- Remove persistence: Windows Run key 'NvmProtocal', macOS LaunchAgent com.nvm.protocal.plist, Linux systemd unit nvmconf.service, and the NodePackages drop directory
- Delete marker files ~/.pkg_history and ~/.pkg_logs and any <tmpdir>/<24hex>.js payload
Workarounds
- Remove all affected @mastra/* versions published 2026-06-17 01:12-02:39 UTC and reinstall from a clean lockfile
- Remove the easy-day-js dependency entirely; the legitimate library is 'dayjs'
Longer-term hardening
- Adopt 'npm install --ignore-scripts' in CI/CD pipelines to neutralize postinstall hooks
- Enforce lockfiles and package cooldown/quarantine periods before adopting new versions
- Audit and revoke scope/publish access for inactive or former contributors; enforce npm 2FA and granular tokens
- Deploy egress filtering / Harden-Runner-style network policy to block raw-IP outbound during builds
Weaknesses (CWE) in Mastra npm Supply Chain Attack
CWE-506, CWE-829, CWE-494, CWE-1357, CWE-295
Timeline of Mastra npm Supply Chain Attack
- Clean decoy easy-day-js@1.11.21 published to npm at 07:05 UTC by account sergey2016 (sergey2016@tutamail.com) to seed the registry.
- Vendors recommend pinning to mastra@1.13.0, running 'npm ls easy-day-js', removing persistence artifacts, and rotating all reachable credentials.
- StepSecurity, SafeDep, and Cyber Security News publish technical analyses detailing the two-stage Node.js infostealer/RAT and C2 infrastructure on Hostwinds (AS54290).
- Microsoft Threat Intelligence and Socket independently identify and disclose the supply-chain compromise.
- Republish burst completes ~02:36-02:39 UTC; 141+ (reported up to 144) @mastra/* packages affected, including @mastra/core (918K weekly downloads), mastra, and create-mastra.
- Victim infection begins immediately as the malicious versions go live: any developer machine, CI/CD runner, or build environment installing an affected @mastra/* package at 'latest' pulls easy-day-js@1.11.22 and triggers the setup.cjs postinstall loader.
- Automated mass-republish of @mastra/* scope begins at 01:12 UTC using hijacked former-contributor account 'ehindero', injecting easy-day-js into each manifest.
- Weaponized easy-day-js@1.11.22 published at 01:01 UTC, carrying the obfuscated postinstall loader setup.cjs.
Sources cited for Mastra npm Supply Chain Attack
- Hackers Compromised 140+ Mastra npm Packages to Deploy Password-Stealing Malware
- Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat
- 144 Mastra npm Packages Compromised via Hijacked Contributor Account
- Mastra npm Scope Takeover: 141 Packages Drop a RAT
- Microsoft Threat Intelligence: supply chain attack on the Mastra-AI npm ecosystem
- OSV malicious package advisory MAL-2026-1078 (easy-day-js)
Threats related to Mastra npm Supply Chain Attack
- Mastra npm Supply-Chain Compromise (@mastra/* namespace) via Typosquatted 'easy-day-js' — Multi-Stage Cross-Platform Infostealer
- Amazon: North Korea's Sapphire Sleet (Stardust Chollima/UNC1069) Compromises Axios, Debug, Chalk, and Typo-Crypto npm Packages in Supply-Chain Campaign
- Sapphire Sleet (DPRK) 'easy-day-js' Supply-Chain Compromise of 140+ Mastra npm Packages via Hijacked Maintainer Account
- AWS Security Hub Extended Supply Chain Security — Open Source Malware Defense at Cloud Scale
- Mastra NPM Packages Trojanized with Malicious Dependency Injection - 116 Packages Compromised
- Miasma Malware Supply Chain Attack Targets npm Packages, Go Module, and GitHub Actions CI/CD Pipelines
Detection coverage for TL-2026-0836
As of 2026-06-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0836 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-0836
4 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.