Skip to content
OriginalSign in
Image: Microsoft

MicrosoftMicrosoft Defender Security Research Team

Microsoft warns of npm supply chain attack via mastra packages

Part of the mastra story · since 17 Jun

Quiet for 19 weekslast report 22 Jun6 articles6 outlets
17 Jun · StepSecurity first27 Aug20 SepNowThis article4th of 6
  • Wed 17 Jun, 02:10 UTC. StepSecurity, first report. Malicious npm packages hit Mastra AI, steal credentials..
  • Wed 17 Jun, 07:50 UTC. The Hacker News, its first report on the story. Hijacked npm Account Leads to 144 Package Compromise in Mastra.
  • Wed 17 Jun, 08:26 UTC. SecurityOnline, its first report on the story. Supply chain attack compromises 140 npm packages via typosquat.
  • Thu 18 Jun, 05:20 UTC. Microsoft, its first report on the story. Microsoft warns of npm supply chain attack via mastra packages. This article, 4th of 6.
  • Mon 22 Jun, 11:30 UTC. SecurityWeek, its first report on the story. North Korean Group Targets NPM Supply Chain, 8M Devs at Risk.
  • Mon 22 Jun, 11:31 UTC. Infosecurity, its first report on the story. North Korean hackers breach Mastra via tainted npm packages.

Microsoft Threat Intelligence reported a significant npm supply chain compromise impacting over 140 packages in the mastra scope, initiated through the takeover of the ehindero npm maintainer account. The attacker published a malicious package, _easy-day-js_, mimicking the popular _dayjs_ library which included a postinstall hook executing harmful scripts upon installation. This compromise affected developer environments running npm install or update, risking exposure of credentials and software integrity.

Microsoft has suggested various mitigations, including reviewing dependency trees, using known-good versions, and checking for indicators of compromise. Notably, Microsoft Defender products are equipped to detect and respond to related threats.

How the story developed

All 6 articles
Quiet for 19 weekslast report 22 Jun6 articles6 outlets

6 articles from 6 outlets since 17 Jun. Quiet since 22 Jun. This was the 4th report, 1 day after the first.

Now17 Jun181920212223241 NovFirst reportStepSecurity · 17 Jun, 02:10This article4th of 6 · day 1Picked up againafter 4 days quiet
  • Wed 17 Jun, 02:10 UTC. StepSecurity, first report. Malicious npm packages hit Mastra AI, steal credentials..
  • Wed 17 Jun, 07:50 UTC. The Hacker News, its first report on the story. Hijacked npm Account Leads to 144 Package Compromise in Mastra.
  • Wed 17 Jun, 08:26 UTC. SecurityOnline, its first report on the story. Supply chain attack compromises 140 npm packages via typosquat.
  • Thu 18 Jun, 05:20 UTC. Microsoft, its first report on the story. Microsoft warns of npm supply chain attack via mastra packages. This article, 4th of 6.
  • Mon 22 Jun, 11:30 UTC. SecurityWeek, its first report on the story. North Korean Group Targets NPM Supply Chain, 8M Devs at Risk.
  • Mon 22 Jun, 11:31 UTC. Infosecurity, its first report on the story. North Korean hackers breach Mastra via tainted npm packages.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 6 articles as a list
  1. Wed 17 JunDay 03
    1. Malicious npm packages hit Mastra AI, steal credentials.02:10 · StepSecurity · First report
    2. Hijacked npm Account Leads to 144 Package Compromise in Mastra07:50 · The Hacker News
    3. Supply chain attack compromises 140 npm packages via typosquat08:26 · SecurityOnline
  2. Thu 18 JunDay 11
    1. Microsoft warns of npm supply chain attack via mastra packages05:20 · Microsoft · This article, 4th of 6

  3. Quiet for 4 days

    Mon 22 JunDay 52
    1. North Korean Group Targets NPM Supply Chain, 8M Devs at Risk11:30 · SecurityWeek · Picked up again
    2. North Korean hackers breach Mastra via tainted npm packages11:31 · Infosecurity

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in