# Mastra npm Packages Trojanized with Malicious easy-day-js Dependency (UNC1069)

> On 2026-06-17 the @mastra npm scope was republished with a typosquatted dependency, easy-day-js (impersonating dayjs), whose obfuscated postinstall dropper downloads a cross-platform infostealer targeting browser data and 160+ cryptocurrency wallet extensions with persistence and C2. Wiz attributes the activity to UNC1069; other reporting cites Microsoft linking it to Sapphire Sleet, and some vendors treat attribution as unconfirmed.

- **Published:** 2026-10-26T04:20:05Z
- **Last reviewed:** 2026-10-26T04:20:05Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4427
- **ID:** TL-2026-4427
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** UNC1069 (North Korea)
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

A dormant npm contributor account (ehindero) that still held unrevoked publish rights to the @mastra scope was taken over (Snyk reports an email change to a tutamail address; Mastra later told reporters that an active employee's machine was compromised through social engineering via a suspicious link sent during a call from a compromised LinkedIn account). On 2026-06-16 07:05 UTC a separate npm account, sergey2016, published a clean 'bait' easy-day-js@1.11.21, a typosquat of the popular dayjs date library. On 2026-06-17 at 01:01 UTC sergey2016 published easy-day-js@1.11.22 tagged latest, containing a malicious postinstall hook.

Between roughly 01:12 and 02:39 UTC on 2026-06-17 the attacker ran an automated, ~88-minute mass-republish of @mastra packages, each with the injected dependency pinned as "easy-day-js": "^1.11.21", so fresh installs resolved to the armed 1.11.22. Package counts differ by source: Wiz reports 116 packages; StepSecurity 140+; Orca and Snyk 142-143 (all @mastra/* plus mastra and create-mastra); The Hacker News 145. Examples include @mastra/core@1.42.1, @mastra/schema-compat@1.2.12 and mastra@1.13.1; combined weekly downloads exceeded 1.1 million. Clean versions such as @mastra/core@1.42.0 and later forward-rolled releases are the remediation target.

The dropper (setup.cjs, 4,572 bytes, run via "postinstall": "node setup.cjs --no-warnings") is obfuscated with a custom-alphabet Base64 scheme and a rotated 40-element string array with a checksum check (0x4c11d). It sets NODE_TLS_REJECT_UNAUTHORIZED=0, writes beacon markers (.pkg_history with the absolute package path and an XOR-encoded .pkg_logs) to the temp directory, spawns a detached unref'd background process, downloads a stage-2 payload from https://23.254.164.92:8000/update/49890878 into a <24-hex>.js file, launches it with the C2 address 23.254.164.123:443, and then deletes itself with fs.rmSync. The C2 URL appears in plaintext within the obfuscated source. Both IPs are Hostwinds (AS54290) in 23.254.164.0/24.

The stage-2 implant (SHA256 221c45a7...badf) is a cross-platform infostealer/RAT. Per Kodem, Snyk and Orca it targets 160+ (166 recovered) wallet extensions (MetaMask, Phantom, Solflare, Coinbase, Binance, OKX, Keplr, TronLink) in Chrome, Edge and Brave, harvests browser history, profiles the host, harvests credentials and API keys (LLM keys, cloud credentials), beacons about every 10 minutes using a self-signed wolfSSL certificate (CN=www.wolfssl.com, expired January 2018), and polls for operator-controlled code execution. On Windows it uses reflective .NET assembly injection into cmd.exe. Persistence masquerades as NVM components: macOS LaunchAgent com.nvm.protocal.plist (implant protocal.cjs) and ~/Library/NodePackages/; Linux systemd user unit nvmconf.service and ~/.config/NodePackages/; Windows HKCU Run key NvmProtocal and C:\ProgramData\NodePackages\.

Attribution is contested: Wiz names UNC1069; The Hacker News reports Microsoft attributed the campaign to Sapphire Sleet (BlueNoroff, North Korea; overlapping with UNC1069) on 2026-06-19 citing tradecraft similar to the earlier Axios compromise (maintainer compromise, clean-then-armed typosquat dependency, postinstall dropper, crypto-stealing payload); Snyk explicitly leaves attribution unconfirmed. No CVE or CVSS is assigned. Treat any host or CI runner that installed an affected version as potentially compromised.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1566.003 Spearphishing via Service
- T1078 Valid Accounts
- T1059.007 JavaScript
- T1059.001 PowerShell
- T1547.001 Registry Run Keys / Startup Folder
- T1543.001 Launch Agent
- T1543.002 Systemd Service
- T1027 Obfuscated Files or Information
- T1070.004 File Deletion
- T1036.005 Match Legitimate Resource Name or Location
- T1055 Process Injection
- T1555.003 Credentials from Web Browsers
- T1082 System Information Discovery
- T1217 Browser Information Discovery
- T1005 Data from Local System
- T1071.001 Web Protocols

## Sources

- [Mastra Packages Trojanized with Malicious Dependency - Wiz Threat Center](https://threats.wiz.io/all-incidents/mastra-packages-trojanized-with-malicious-dependency)
- [Mastra npm Packages Compromised Using easy-day-js - StepSecurity](https://www.stepsecurity.io/blog/mastra-npm-packages-compromised-using-easy-day-js)
- [A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope - Snyk](https://snyk.io/blog/a-forgotten-contributor-account-compromised-the-entire-mastra-npm-package-scope/)
- [144 Mastra npm Packages Compromised via Supply Chain Attack - Orca Security](https://orca.security/resources/blog/mastra-npm-supply-chain-attack/)
- [145 Mastra npm Packages Compromised via Hijacked Contributor Account - The Hacker News](https://thehackernews.com/2026/06/144-mastra-npm-packages-compromised-via.html)
- [Mastra npm Compromise: easy-day-js Attack & Response - Kodem Security](https://www.kodemsecurity.com/resources/mastra-npm-packages-compromised-easy-day-js-supply-chain-attack-iocs-and-response-runbook)
- [Mastra npm packages compromised in 'easy-day-js' supply chain attack - SC Media](https://www.scworld.com/brief/mastra-npm-packages-compromised-in-easy-day-js-supply-chain-attack)
- [Hijacked Mastra npm Account Spread easy-day-js Info-Stealer to 144 Packages - Mallory](https://www.mallory.ai/stories/019ed38a-03f8-71a7-a8a3-8aa5d17d93df)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4427