Threat reportSupply ChainTL-2026-4427
Mastra npm Packages Trojanized with Malicious easy-day-js Dependency (UNC1069)
Mastra npm Packages Trojanized with Malicious easy-day-js (TL-2026-4427), also tracked as easy-day-js supply chain attack, is a high-severity supply-chain compromise, first published 2026-10-26. It is attributed to UNC1069 (North Korea) with medium confidence, affects Mastra @mastra/* npm packages (incl. @mastra/core, maps to 17 MITRE ATT&CK techniques (T1005, T1027, T1036.005), and is covered by 9 detection rules and 22 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 17MITRE ATT&CK
- Actors
- 1UNC1069
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 22Indicators of compromise
Key facts for TL-2026-4427
- Threat ID
- TL-2026-4427
- Also known as
- easy-day-js supply chain attack, Mastra npm scope takeover
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution
- UNC1069
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- technology, software development, artificial intelligence, cryptocurrency, finance
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in Mastra npm Packages Trojanized with Malicious easy-day-js
Malware and tooling: protocal.cjs
How Mastra npm Packages Trojanized with Malicious easy-day-js works
On 2026-06-17 the @mastra npm scope was republished with a typosquatted dependency, easy-day-js (impersonating dayjs), whose obfuscated postinstall dropper downloads a cross-platform infostealer targeting browser data and 160+ cryptocurrency wallet extensions with persistence and C2. Wiz attributes the activity to UNC1069; other reporting cites Microsoft linking it to Sapphire Sleet, and some vendors treat attribution as unconfirmed.
A dormant npm contributor account (ehindero) that still held unrevoked publish rights to the @mastra scope was taken over (Snyk reports an email change to a tutamail address; Mastra later told reporters that an active employee's machine was compromised through social engineering via a suspicious link sent during a call from a compromised LinkedIn account). On 2026-06-16 07:05 UTC a separate npm account, sergey2016, published a clean 'bait' easy-day-js@1.11.21, a typosquat of the popular dayjs date library. On 2026-06-17 at 01:01 UTC sergey2016 published easy-day-js@1.11.22 tagged latest, containing a malicious postinstall hook.
Between roughly 01:12 and 02:39 UTC on 2026-06-17 the attacker ran an automated, ~88-minute mass-republish of @mastra packages, each with the injected dependency pinned as "easy-day-js": "^1.11.21", so fresh installs resolved to the armed 1.11.22. Package counts differ by source: Wiz reports 116 packages; StepSecurity 140+; Orca and Snyk 142-143 (all @mastra/* plus mastra and create-mastra); The Hacker News 145. Examples include @mastra/core@1.42.1, @mastra/schema-compat@1.2.12 and mastra@1.13.1; combined weekly downloads exceeded 1.1 million. Clean versions such as @mastra/core@1.42.0 and later forward-rolled releases are the remediation target.
The dropper (setup.cjs, 4,572 bytes, run via "postinstall": "node setup.cjs --no-warnings") is obfuscated with a custom-alphabet Base64 scheme and a rotated 40-element string array with a checksum check (0x4c11d). It sets NODE_TLS_REJECT_UNAUTHORIZED=0, writes beacon markers (.pkg_history with the absolute package path and an XOR-encoded .pkg_logs) to the temp directory, spawns a detached unref'd background process, downloads a stage-2 payload from https://23.254.164.92:8000/update/49890878 into a <24-hex>.js file, launches it with the C2 address 23.254.164.123:443, and then deletes itself with fs.rmSync. The C2 URL appears in plaintext within the obfuscated source. Both IPs are Hostwinds (AS54290) in 23.254.164.0/24.
The stage-2 implant (SHA256 221c45a7...badf) is a cross-platform infostealer/RAT. Per Kodem, Snyk and Orca it targets 160+ (166 recovered) wallet extensions (MetaMask, Phantom, Solflare, Coinbase, Binance, OKX, Keplr, TronLink) in Chrome, Edge and Brave, harvests browser history, profiles the host, harvests credentials and API keys (LLM keys, cloud credentials), beacons about every 10 minutes using a self-signed wolfSSL certificate (CN=www.wolfssl.com, expired January 2018), and polls for operator-controlled code execution. On Windows it uses reflective .NET assembly injection into cmd.exe. Persistence masquerades as NVM components: macOS LaunchAgent com.nvm.protocal.plist (implant protocal.cjs) and ~/Library/NodePackages/; Linux systemd user unit nvmconf.service and ~/.config/NodePackages/; Windows HKCU Run key NvmProtocal and C:\ProgramData\NodePackages\.
Attribution is contested: Wiz names UNC1069; The Hacker News reports Microsoft attributed the campaign to Sapphire Sleet (BlueNoroff, North Korea; overlapping with UNC1069) on 2026-06-19 citing tradecraft similar to the earlier Axios compromise (maintainer compromise, clean-then-armed typosquat dependency, postinstall dropper, crypto-stealing payload); Snyk explicitly leaves attribution unconfirmed. No CVE or CVSS is assigned. Treat any host or CI runner that installed an affected version as potentially compromised.
MITRE ATT&CK techniques used in TL-2026-4427
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1070.004 File Deletion
Execution
T1059.001 PowerShell; T1059.007 JavaScript
Command and Control
Initial Access
T1078 Valid Accounts; T1195.002 Compromise Software Supply Chain; T1566.003 Spearphishing via Service
Discovery
T1082 System Information Discovery; T1217 Browser Information Discovery
Persistence
T1543.001 Launch Agent; T1543.002 Systemd Service; T1547.001 Registry Run Keys / Startup Folder
Credential Access
Affected products and versions in Mastra npm Packages Trojanized with Malicious easy-day-js
- Mastra — @mastra/* npm packages (incl. @mastra/core, @mastra/schema-compat, mastra, create-mastra)
Vulnerable versions: @mastra/core@1.42.1; @mastra/schema-compat@1.2.12; mastra@1.13.1; all versions published 2026-06-17 01:12-02:39 UTC depending on easy-day-js
Fixed in: @mastra/core@1.42.0 and later clean forward-rolled releases - easy-day-js (attacker) — easy-day-js npm package
Vulnerable versions: 1.11.22
Remediation for Mastra npm Packages Trojanized with Malicious easy-day-js
Patches
- Upgrade to clean Mastra releases (e.g., @mastra/core@1.42.0 or later forward-rolled versions) that no longer depend on easy-day-js
Immediate actions
- Run 'npm ls easy-day-js' and grep all lockfiles and CI caches for easy-day-js 1.11.21/1.11.22
- Block egress to 23.254.164.92, 23.254.164.123 and 23.254.164.0/24
- Hunt for and remove persistence: com.nvm.protocal.plist, nvmconf.service, NvmProtocal Run key, NodePackages directories; kill detached node processes
- Rotate all credentials reachable from affected hosts: npm tokens, GITHUB_TOKEN, cloud keys, LLM API keys, SSH keys, CI/CD secrets
- Move cryptocurrency from wallet extensions present on affected hosts to wallets created on clean devices
- Prioritize reimaging of CI runners and developer workstations that installed affected versions
Workarounds
- Remove easy-day-js from dependency trees and pin known-good versions via overrides/resolutions until upgraded
Longer-term hardening
- Set 'npm config set ignore-scripts true' by default and allow install scripts only by exception
- Commit lockfiles and use 'npm ci' to prevent silent re-resolution of caret ranges
- Require SLSA provenance attestations for consumed packages
- Enforce MFA and remove token-based publish bypass on npm accounts; audit and expire stale scope maintainers
- Deploy runtime egress controls on CI runners (e.g., StepSecurity Harden Runner in block mode)
Weaknesses (CWE) in Mastra npm Packages Trojanized with Malicious easy-day-js
Timeline of Mastra npm Packages Trojanized with Malicious easy-day-js
- npm account sergey2016 publishes clean bait package easy-day-js@1.11.21 (07:05 UTC), a typosquat of dayjs, to establish a benign history.
- Mastra forward-rolls clean releases (e.g., @mastra/core@1.42.0 and later) that drop the easy-day-js dependency and begins incident response.
- Wiz Threat Center and StepSecurity publish analyses; StepSecurity Harden Runner blocks the stage-2 download from 23.254.164.92:8000 in block mode and the IP is added to its global block list.
- Automated campaign ends around 02:36-02:39 UTC after ~88 minutes; counts reported range from 116 (Wiz) to 145 packages (The Hacker News), exceeding 1.1 million combined weekly downloads.
- Using the hijacked dormant contributor account ehindero, the attacker begins republishing @mastra packages with easy-day-js ^1.11.21 injected (01:12 UTC).
- easy-day-js@1.11.22 with the obfuscated setup.cjs postinstall dropper is published and tagged latest (01:01 UTC).
- The Hacker News reports Microsoft attributed the campaign to Sapphire Sleet (BlueNoroff, overlapping UNC1069) citing similarity to the earlier Axios compromise; Wiz also attributes it to UNC1069.
Sources cited for Mastra npm Packages Trojanized with Malicious easy-day-js
- Mastra Packages Trojanized with Malicious Dependency - Wiz Threat Center
- Mastra npm Packages Compromised Using easy-day-js - StepSecurity
- A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope - Snyk
- 144 Mastra npm Packages Compromised via Supply Chain Attack - Orca Security
- 145 Mastra npm Packages Compromised via Hijacked Contributor Account - The Hacker News
- Mastra npm Compromise: easy-day-js Attack & Response - Kodem Security
- Mastra npm packages compromised in 'easy-day-js' supply chain attack - SC Media
- Hijacked Mastra npm Account Spread easy-day-js Info-Stealer to 144 Packages - Mallory
Detection coverage for TL-2026-4427
As of 2026-10-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4427 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4427
3 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.