Provenance Record

Well-structured News piece (791 words, within the 400-1200 News range). Clear Overview / What We Know / The Scale / What We Don't Know / Analysis sections. Reporting is descriptive and stays at the incident-reporting level: it does not reproduce or expand attack code, payload internals, or step-by-step exploitation mechanics, which is appropriate for a disclosed security incident.

All 6 source snapshots read from disk (all fetched status_code 200). source-0.html.gz (Microsoft Security Blog): CONFIRMED all four attributed quotes verbatim — '140+ packages across the mastra and @mastra scopes', 'with high confidence that this activity is attributable to Sapphire Sleet', 'a North Korean state actor that primarily targets the financial sector', and the full 'ehindero npm maintainer account' takeover sentence. source-1.html.gz (JFrog Security Research): CONFIRMED 'This campaign includes 143 affected Mastra packages and a single malicious dependency, easy-day-js' verbatim; CONFIRMED the two-stage timeline — npm registry metadata records easy-day-js@1.11.21 at 2026-06-16 and easy-day-js@1.11.22 at 2026-06-17, matching the article's June 16 / June 17 dating and clean-then-weaponized framing. source-2.html.gz (StepSecurity): CONFIRMED 'Over the next 88 minutes, 140+ packages across the entire Mastra ecosystem were republished' and 'Packages with a combined weekly download count exceeding 1.1 million were exposed' verbatim; CONFIRMED impersonation details (author metadata iamkun, homepage, repository URL, MIT license, 1.11.x versioning). source-3.html.gz (Snyk): CONFIRMED 'signs of takeover rather than insider action, including an email change away from the contributor's original address' and '142 publishable packages across the @mastra/* scope plus mastra, create-mastra, and mastracode' verbatim; CONFIRMED @mastra/core ~4 million downloads/month and mastra ~1.5 million more, aggregate into the tens of millions. source-4.html.gz (RH-ISAC): CONFIRMED the 'ehindero' account hijack quote verbatim (curly quotes in source) and the 144-package figure and maintainer-phishing framing. source-5.html.gz (Sonatype): CONFIRMED 'a malicious package designed to impersonate the popular JavaScript date library dayjs', tracking id sonatype-2026-003926, and the postinstall / second-stage-payload description verbatim. Package-count figures cross-checked: 142 correctly attributed to Snyk, 143 to JFrog, 144 to RH-ISAC — each number maps to the outlet that reported it.

Every specific (dates, version numbers, package counts, download figures, threat-actor name, account name, campaign id) traces to a cited source and matches the snapshot. No hallucinated quotes or fabricated specifics detected. The article correctly attributes the differing package counts to their respective outlets and correctly frames Microsoft's attribution as Microsoft Threat Intelligence's own assessment.

Accurate, well-sourced, neutral News report on a publicly disclosed npm supply-chain incident. All quotes verbatim and all specifics traced to cited snapshots. Approved with a corrections record filed to transparently note the two off-allowlist (but reputable and fully verified) sources.