Skip to content
OriginalSign in
Image: The Hacker News

The Hacker Newsinfo@thehackernews.com (The Hacker News)

Hijacked npm Account Leads to 144 Package Compromise in Mastra

Part of the Mastra story · since 17 Jun

Quiet for 19 weekslast report 22 Jun6 articles6 outlets
17 Jun · StepSecurity first27 Aug20 SepNowThis article2nd of 6
  • Wed 17 Jun, 02:10 UTC. StepSecurity, first report. Malicious npm packages hit Mastra AI, steal credentials..
  • Wed 17 Jun, 07:50 UTC. The Hacker News, its first report on the story. Hijacked npm Account Leads to 144 Package Compromise in Mastra. This article, 2nd of 6.
  • Wed 17 Jun, 08:26 UTC. SecurityOnline, its first report on the story. Supply chain attack compromises 140 npm packages via typosquat.
  • Thu 18 Jun, 05:20 UTC. Microsoft, its first report on the story. Microsoft warns of npm supply chain attack via mastra packages.
  • Mon 22 Jun, 11:30 UTC. SecurityWeek, its first report on the story. North Korean Group Targets NPM Supply Chain, 8M Devs at Risk.
  • Mon 22 Jun, 11:31 UTC. Infosecurity, its first report on the story. North Korean hackers breach Mastra via tainted npm packages.

The article discusses the compromise of 144 npm packages within the Mastra ecosystem following a hijacked contributor account. Key points include: 1. The breach highlights vulnerabilities in package management systems, especially within open-source software repositories. 2. Security measures are emphasized, such as ensuring verification of contributor identities and maintaining robust access controls. 3.

The incident raises concerns over the potential for malware injection and the risks associated with third-party dependencies in software development. It serves as a cautionary tale for developers to remain vigilant about supply chain security.

How the story developed

All 6 articles
Quiet for 19 weekslast report 22 Jun6 articles6 outlets

6 articles from 6 outlets since 17 Jun. Quiet since 22 Jun. This was the 2nd report, 6 hours after the first.

Now17 Jun181920212223241 NovFirst reportStepSecurity · 17 Jun, 02:10This article2nd of 6 · day 0Picked up againafter 4 days quiet
  • Wed 17 Jun, 02:10 UTC. StepSecurity, first report. Malicious npm packages hit Mastra AI, steal credentials..
  • Wed 17 Jun, 07:50 UTC. The Hacker News, its first report on the story. Hijacked npm Account Leads to 144 Package Compromise in Mastra. This article, 2nd of 6.
  • Wed 17 Jun, 08:26 UTC. SecurityOnline, its first report on the story. Supply chain attack compromises 140 npm packages via typosquat.
  • Thu 18 Jun, 05:20 UTC. Microsoft, its first report on the story. Microsoft warns of npm supply chain attack via mastra packages.
  • Mon 22 Jun, 11:30 UTC. SecurityWeek, its first report on the story. North Korean Group Targets NPM Supply Chain, 8M Devs at Risk.
  • Mon 22 Jun, 11:31 UTC. Infosecurity, its first report on the story. North Korean hackers breach Mastra via tainted npm packages.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 6 articles as a list
  1. Wed 17 JunDay 03
    1. Malicious npm packages hit Mastra AI, steal credentials.02:10 · StepSecurity · First report
    2. Hijacked npm Account Leads to 144 Package Compromise in Mastra07:50 · The Hacker News · This article, 2nd of 6
    3. Supply chain attack compromises 140 npm packages via typosquat08:26 · SecurityOnline
  2. Thu 18 JunDay 11
    1. Microsoft warns of npm supply chain attack via mastra packages05:20 · Microsoft

  3. Quiet for 4 days

    Mon 22 JunDay 52
    1. North Korean Group Targets NPM Supply Chain, 8M Devs at Risk11:30 · SecurityWeek · Picked up again
    2. North Korean hackers breach Mastra via tainted npm packages11:31 · Infosecurity

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in