Microsoft has linked the recent Mastra supply chain attack to Sapphire Sleet, a North Korean threat group also known as BlueNoroff. The campaign compromised more than 140 npm packages after attackers hijacked a maintainer account and inserted malicious code into trusted software updates.
The incident affected the Mastra AI ecosystem and exposed developers to malware designed to steal credentials, authentication tokens, API keys, and cryptocurrency wallet data. The attribution adds another high-profile supply chain operation to a growing list of attacks targeting open-source software projects.
Attackers Hijacked a Trusted npm Account
According to Microsoft, the campaign began after attackers gained access to the npm account “ehindero.” The account had publishing privileges across the Mastra package environment, giving the threat actors a direct path into the software distribution chain.
After taking control of the account, the attackers published malicious updates across more than 140 packages. Because the updates came from a trusted source, developers had little reason to suspect anything unusual.
This approach allowed the malicious code to spread through normal software installation processes. Developers who installed the affected packages unknowingly downloaded malware onto their systems.
Malicious Dependency Delivered Malware
The attackers inserted a dependency called “easy-day-js” into the compromised packages. The package mimicked the legitimate JavaScript library “dayjs,” a tactic known as typosquatting.
Once installed, the dependency executed a post-install script that deployed a malware dropper. The malware then downloaded additional payloads designed to collect sensitive information from infected systems.
Researchers found that the malware targeted developer environments specifically. Stolen data included authentication tokens, API credentials, browser information, and cryptocurrency wallet details.
The targeting aligns closely with previous campaigns attributed to Sapphire Sleet.
Microsoft Blames Sapphire Sleet
Microsoft said it has high confidence that Sapphire Sleet carried out the operation. The threat group has a long history of financially motivated cybercrime and frequently targets organizations connected to cryptocurrency and financial services.
Security researchers have tracked Sapphire Sleet for years. The group often combines social engineering, credential theft, and malware deployment to gain access to valuable digital assets.
While North Korean threat actors traditionally focused on government and intelligence targets, several groups have increasingly shifted toward operations that generate revenue. Cryptocurrency theft remains one of their primary objectives.
The latest attack continues that trend by targeting developers who may have access to sensitive credentials and digital assets.
Supply Chain Threats Continue to Grow
The incident highlights the growing danger of software supply chain attacks. Rather than breaching organizations directly, attackers compromise trusted software components that many organizations rely on.
This strategy allows malicious code to reach a large number of victims through legitimate update mechanisms. As a result, even organizations with strong security controls can become exposed through third-party dependencies.
Open-source ecosystems remain particularly attractive targets because developers often install packages directly from public repositories. A single compromised maintainer account can affect thousands of downstream users within hours.
Security teams increasingly recommend stricter package monitoring, dependency reviews, and stronger account protections for software maintainers.
Conclusion
The Mastra supply chain attack demonstrates how quickly attackers can abuse trusted software ecosystems once they gain access to a privileged account. Microsoft’s attribution to Sapphire Sleet suggests the operation was part of a broader effort to steal credentials and cryptocurrency-related assets.
As supply chain attacks become more common, organizations will need greater visibility into their software dependencies and stronger controls around package management. Without those safeguards, a single compromised update can create risks that extend far beyond the original target.
0 responses to “Mastra Supply Chain Attack Tied to North Korean Hackers”