# Mastra npm Supply Chain Attack: 141 @mastra/* Packages Backdoored via easy-day-js Typosquat to Deploy Cross-Platform Infostealer/RAT

> On 2026-06-17 an attacker used a hijacked former-contributor npm account (ehindero) to mass-republish 141+ @mastra/* packages (including @mastra/core, 918K weekly downloads, and mastra/create-mastra) with a single injected dependency: easy-day-js, a dayjs typosquat. easy-day-js@1.11.22 ran an obfuscated postinstall loader (setup.cjs) that disabled TLS verification, downloaded a second-stage cross-platform Node.js infostealer/RAT (protocal.cjs), and self-deleted. The implant inventories 160+ crypto wallet extensions, steals browser history, installs Node-themed persistence on Windows/macOS/Linux, and beacons to live C2 23.254.164.123:443.

- **Published:** 2026-06-17T00:00:00Z
- **Last reviewed:** 2026-06-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0836
- **ID:** TL-2026-0836
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Microsoft Threat Intelligence and Socket independently disclosed a high-impact npm supply-chain compromise of the Mastra AI agent framework on 2026-06-17. The attacker leveraged the npm account 'ehindero', a legitimate former Mastra contributor whose scope (publish) access to the @mastra organization had never been revoked, to mass-publish malicious versions across the scope. In an automated 88-minute burst (01:12-02:39 UTC) 141+ (reported as high as 144) @mastra/* packages were republished, each with a single change: a new phantom dependency 'easy-day-js' pinned as '^1.11.21'. The most heavily downloaded affected package, @mastra/core, draws ~918,000 weekly downloads; combined affected weekly downloads exceeded ~1.1 million.

The malicious dependency was staged in advance by a separate npm identity, 'sergey2016' (sergey2016@tutamail.com). A clean decoy easy-day-js@1.11.21 was published 2026-06-16 07:05 UTC to seed the registry, and the weaponized easy-day-js@1.11.22 was published 2026-06-17 01:01 UTC, minutes before the scope-wide republish. easy-day-js is a typosquat clone of the popular dayjs date library.

Stage 1 (loader): easy-day-js@1.11.22 carried a postinstall hook 'node setup.cjs --no-warnings' that fires during npm install on developer machines, CI/CD runners, and build environments. setup.cjs (~4,572 bytes, obfuscated with obfuscator.io) sets NODE_TLS_REJECT_UNAUTHORIZED=0 to disable TLS certificate validation, writes campaign-tracking marker files (~/.pkg_history holding the install path and ~/.pkg_logs holding an XOR-encoded package name), fetches the Stage-2 payload from 23.254.164.92:8000/update/49890878, writes it to a temp file named with 24 hex characters (<tmpdir>/<24hex>.js), spawns it as a detached background process (stdio:'ignore', windowsHide:true), establishes a C2 connection to 23.254.164.123:443, and self-deletes to minimize forensic traces.

Stage 2 (implant): protocal.cjs is a ~41 KB cross-platform Node.js tasking client / RAT. It installs Node-themed persistence disguised as legitimate Node.js tooling: a Windows HKCU CurrentVersion\Run key named 'NvmProtocal', a macOS LaunchAgent 'com.nvm.protocal.plist', and a Linux systemd user unit 'nvmconf.service', dropping artifacts under a 'NodePackages' directory. It inventories 166 cryptocurrency wallet browser extensions (MetaMask, Phantom, Coinbase Wallet, Binance Wallet, TronLink and others), extracts Chrome/Edge/Brave browser history via SQLite, performs host reconnaissance (running processes, installed applications), exfiltrates over the C2 channel, and polls for arbitrary C2 commands and additional module deployment.

The campaign infrastructure (23.254.164.92, 23.254.164.123) is hosted on Hostwinds LLC (AS54290), with associated reverse-DNS hostnames hwsrv-1327786.hostwindsdns.com and hwsrv-1327785.hostwindsdns.com. Remediation: run 'npm ls easy-day-js' to identify exposure, roll back/pin to the safe mastra@1.13.0 release using lockfiles, treat any machine that installed an affected @mastra/* version since 2026-06-16 as compromised, remove cross-platform persistence artifacts, rotate all reachable credentials (npm/GitHub tokens, cloud keys, LLM API keys, CI/CD secrets), move crypto assets to fresh wallets on clean devices, and adopt 'npm install --ignore-scripts', enforced lockfiles, and package cooldown periods.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1586 Compromise Accounts
- T1608 Stage Capabilities
- T1195 Supply Chain Compromise
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1547 Boot or Logon Autostart Execution
- T1543 Create or Modify System Process
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1539 Steal Web Session Cookie
- T1552 Unsecured Credentials
- T1057 Process Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel

## Sources

- [Hackers Compromised 140+ Mastra npm Packages to Deploy Password-Stealing Malware](https://cybersecuritynews.com/140-mastra-npm-packages-compromised/)
- [Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat](https://www.stepsecurity.io/blog/mastra-npm-packages-compromised-using-easy-day-js)
- [144 Mastra npm Packages Compromised via Hijacked Contributor Account](https://thehackernews.com/2026/06/144-mastra-npm-packages-compromised-via.html)
- [Mastra npm Scope Takeover: 141 Packages Drop a RAT](https://safedep.io/mastra-npm-scope-takeover-supply-chain-attack/)
- [Microsoft Threat Intelligence: supply chain attack on the Mastra-AI npm ecosystem](https://x.com/MsftSecIntel/status/2067099387101335909)
- [OSV malicious package advisory MAL-2026-1078 (easy-day-js)](https://osv.dev/vulnerability/MAL-2026-1078)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0836