Loading story…
A software supply chain attack compromised up to 144 @mastra/* npm packages after an attacker abused lingering publish access on a former contributor account and pushed tainted releases into the widely used JavaScript and TypeScript AI framework ecosystem. The malicious package versions did not contain the payload directly; instead, they added a dependency on easy-day-js, a typosquatted package impersonating the legitimate dayjs library. Investigators said the attacker first published a benign-looking easy-day-js@1.11.21, then followed with malicious easy-day-js@1.11.22 before releasing compromised Mastra packages that referenced the permissive version range ^1.11.21, allowing the harmful dependency to be pulled in during installation.
Trace attribution and downstream blast radius.
7 events from the most recent confirmed update back to the earliest known activity.
A Microsoft security blog linked in the new reference attributed the Mastra npm supply chain compromise to Sapphire Sleet. This adds a named threat actor assessment to the previously reported easy-day-js and compromised @mastra package activity.
Following the discovery, npm removed malicious versions from the most prominent affected packages and reverted their latest tags. Defenders advised users who installed the affected versions to treat hosts as potentially compromised, roll back packages, rotate credentials, and investigate for artifacts.
In response to the npm compromise, Mastra disabled token-based npm publishing and required multi-factor authentication for all publishes. The change was announced alongside guidance for users to audit dependencies, inspect logs, update to clean versions, and rotate credentials on affected systems.
After the @mastra npm scope compromise, Mastra removed the unauthorized owner account used in the attack and published clean forward-rolled package releases to replace the compromised versions. The report also noted the source repository was not modified and the malicious dependency was inserted during package publishing.
Researchers reported a software supply chain attack dubbed easy-day-js affecting up to 144 npm packages in the @mastra/* namespace. Their analysis described the malicious dependency chain, the obfuscated loader behavior, and the final payload's information-stealing capabilities.
On 2026-06-17, an attacker using access to the @mastra npm organization published malicious Mastra package versions that added a dependency on easy-day-js@1.11.22. The malicious package used a postinstall hook to fetch and run a second-stage payload, and the activity was tied to a hijacked contributor account with lingering publish access.
The attacker first published a benign-looking easy-day-js version 1.11.21, apparently to establish credibility before the malicious stage of the campaign. This package later served as the dependency name used in compromised Mastra releases.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 26 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
33 references tracked. Mallory keeps watching after this page renders.
aikido.dev
Open sourceinfosecurity-magazine.com
Open sourcesecurityweek.com
Open sourcecybersecuritynews.com
Open sourcesnyk.io
Open sourceresearch.jfrog.com
Open sourceflare.io
Open sourcelinkedin.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A large-scale attack on the NPM (Node Package Manager) ecosystem has been uncovered, involving the publication of over 64,000 malicious packages by a coordinated group known as the IndonesianFoods worm. This campaign, active for more than two years, leveraged at least seven newly created NPM user accounts to distribute the malicious packages, which are notable for their consistent naming patterns and unusual internal dictionary. The attackers focused on creating new packages rather than stealing credentials, and the scale of the operation more than doubles the previously known number of malicious NPM packages. Security researchers have made available a comprehensive list of the affected packages and user accounts for further analysis. In a separate but related incident, researchers identified a highly popular fake NPM package, "@acitons/artifact," which was downloaded over 206,000 times. This package used a typosquatting technique to mimic the legitimate GitHub Actions Toolkit and was designed to steal GitHub credentials by executing a malicious post-install script. The attack highlights the growing threat of software supply chain compromises, with the malicious package aiming to exfiltrate tokens from build environments and potentially publish further malicious artifacts. Both incidents underscore the increasing sophistication and scale of supply chain attacks targeting the JavaScript development community.
Jun 29, 2026
Researchers linked a threat actor tracked as **RED-LILI** to a large-scale software supply chain attack that pushed nearly **800 malicious packages** to the **npm** registry in a burst of activity over roughly a week. Checkmarx reported the operation began around February 23, 2022, and relied on a highly automated pipeline that created a separate npm account for each package, complicating bulk detection and takedown efforts. The campaign used custom Python tooling, Selenium, and the open-source **Interactsh** project to automate account creation and bypass npm email one-time-password verification during signup. The malicious packages were part of a broader effort to compromise developers and downstream environments through common package ecosystem abuse techniques, including **typosquatting** and **dependency confusion**. Reporting tied the activity to packages crafted to target organizations such as **Azure, Uber, and Airbnb**, underscoring how attackers can industrialize package publication at scale and turn open-source repositories into an efficient delivery channel for supply chain compromise.
Aug 15, 2026
Attackers abused the npm account **`atool`**—linked to the maintainer of **`timeago.js`** and with publish rights across Alibaba’s **AntV** ecosystem—to push malicious releases into widely used JavaScript packages. Reporting from StepSecurity, SafeDep, Aikido Security, and CSO indicates the campaign affected packages including **`timeago.js`**, **`echarts-for-react`**, **`size-sensor`**, and numerous **`@antv/*`** libraries used for charting, graphing, rendering, mapping, and spreadsheet functions in web applications and dashboards. Researchers said the attacker published malicious code at scale, with one account citing **637 malicious versions across 317 packages in about 22 minutes**, while another identified **143 compromised packages** with affected versions. The payload was described as a **CI/CD credential stealer** and linked by some researchers to the **Mini-Shai-Hulud** worm, raising concern because the infected packages are commonly pulled into front-end builds and automated pipelines such as **GitHub Actions**, **GitLab CI**, and Kubernetes-hosted CI systems, where exposed tokens and cloud credentials could enable broader downstream compromise.
Jun 29, 2026