Microsoft Ties Mastra npm Supply-Chain Attack to North Korea's Sapphire Sleet as 'easy-day-js' Typosquat Poisons 140-Plus AI Packages

Overview

More than 140 npm packages belonging to Mastra, a widely used open-source JavaScript and TypeScript framework for building AI applications, were compromised on June 17, 2026, in an automated software supply-chain attack. According to the Microsoft Security Blog, “Microsoft Threat Intelligence observed a large-scale npm supply chain attack affecting 140+ packages across the mastra and @mastra scopes on the npm registry.” Microsoft assessed “with high confidence that this activity is attributable to Sapphire Sleet, a North Korean state actor that primarily targets the financial sector,” per the Microsoft Security Blog.

The attack did not modify the packages’ source code. Instead, the poisoned releases each added a single malicious dependency: a typosquatted package named easy-day-js that impersonated the popular dayjs date library.

What We Know

The compromise traced back to a single hijacked account with publishing rights across the framework. According to the Microsoft Security Blog, “The compromise originated from the takeover of the ehindero npm maintainer account, which had publish rights across the Mastra ecosystem and was used to publish poisoned package versions that introduced easy-day-js, a malicious typosquat of the popular dayjs library.”

Snyk described ehindero as a real former Mastra contributor whose scope access was never revoked. The same analysis noted the account showed “signs of takeover rather than insider action, including an email change away from the contributor’s original address,” and that it had published legitimate alpha releases of @mastra/core in late 2024 and early 2025 before going dormant. RH-ISAC characterized the incident as a maintainer phishing attack, describing how “the threat actors hijacked the ‘ehindero’ account, a legitimate former Mastra contributor.”

The malicious dependency was built to pass casual inspection. According to StepSecurity, the attacker copied the legitimate dayjs library’s author, homepage, repository, MIT license, and 1.11.x version numbering so the package would look credible. Sonatype similarly described it as “a malicious package designed to impersonate the popular JavaScript date library dayjs,” and tracked the campaign under the identifier sonatype-2026-003926.

The attackers staged the operation across two days. Per JFrog Security Research, a clean, functional copy of the package, easy-day-js@1.11.21, was published on June 16, 2026, followed by a weaponized version, easy-day-js@1.11.22, on June 17, 2026. Once the malicious version was live, the affected Mastra packages were republished in a compressed window. StepSecurity reported that “Over the next 88 minutes, 140+ packages across the entire Mastra ecosystem were republished” with easy-day-js added as a dependency.

At a high level, the malicious dependency ran during installation rather than at runtime. Sonatype reported that “Once installed, the package used a postinstall script to attempt to download and run a second-stage payload from attacker-controlled infrastructure,” a hook that Sonatype noted “run automatically after npm installs a package.” Microsoft’s account of the payload behavior aligns with that description without requiring the compromised package to be imported into an application.

The Scale

Estimates of exposure vary by researcher. StepSecurity reported that “Packages with a combined weekly download count exceeding 1.1 million were exposed.” Snyk put the framework’s reach higher, noting that @mastra/core alone pulls about 4 million downloads a month and that mastra adds roughly 1.5 million more, with aggregate monthly volume running into the tens of millions.

The exact count of affected packages differs across reports. JFrog Security Research stated that “This campaign includes 143 affected Mastra packages and a single malicious dependency, easy-day-js.” RH-ISAC cited 144 packages, while Snyk said Mastra’s remediation enumerated “142 publishable packages across the @mastra/* scope plus mastra, create-mastra, and mastracode.” Microsoft and StepSecurity both described the total as more than 140.

What We Don’t Know

Several aspects of the incident remain unresolved in public reporting. The precise method by which the ehindero maintainer account was taken over has not been detailed beyond the phishing framing offered by RH-ISAC. The number of downstream projects that actually installed a poisoned version during the exposure window is not established in the cited reporting, nor is a full accounting of victims. As of the cited disclosures, Microsoft’s attribution to Sapphire Sleet reflects Microsoft Threat Intelligence’s own assessment; not every outlet covering the incident named a threat actor.

Analysis

The Mastra compromise fits a pattern security researchers have tracked across the npm and PyPI registries: rather than exploiting a software flaw, attackers target the human and account layer of the software supply chain. In this case, a dormant contributor account that retained publishing rights became the single point of failure for an entire package scope, and a lookalike dependency—rather than altered source code—carried the payload. The attribution to a state actor that Microsoft says “primarily targets the financial sector,” combined with the framework’s role in building AI applications, underscores why registry maintainers and downstream consumers continue to scrutinize install-time scripts and stale account permissions.