Skip to content
OriginalSign in
Image: StepSecurity

StepSecurity

Malicious npm packages hit Mastra AI, steal credentials.

Part of the Mastra story · since 17 Jun

Quiet for 19 weekslast report 22 Jun6 articles6 outlets
17 Jun · StepSecurity first27 Aug20 SepNowThis article1st of 6
  • Wed 17 Jun, 02:10 UTC. StepSecurity, first report. Malicious npm packages hit Mastra AI, steal credentials.. This article, 1st of 6.
  • Wed 17 Jun, 07:50 UTC. The Hacker News, its first report on the story. Hijacked npm Account Leads to 144 Package Compromise in Mastra.
  • Wed 17 Jun, 08:26 UTC. SecurityOnline, its first report on the story. Supply chain attack compromises 140 npm packages via typosquat.
  • Thu 18 Jun, 05:20 UTC. Microsoft, its first report on the story. Microsoft warns of npm supply chain attack via mastra packages.
  • Mon 22 Jun, 11:30 UTC. SecurityWeek, its first report on the story. North Korean Group Targets NPM Supply Chain, 8M Devs at Risk.
  • Mon 22 Jun, 11:31 UTC. Infosecurity, its first report on the story. North Korean hackers breach Mastra via tainted npm packages.

On June 17, 2026, an attacker compromised the @mastra npm organization, publishing malicious versions of 13 packages within the Mastra AI framework. These packages included 'easy-day-js', a typosquat of the popular 'dayjs' library, containing a postinstall script that executed an obfuscated JavaScript file. This script downloaded and ran a second-stage payload aimed at extracting sensitive information such as API keys and cloud credentials.

The attack unfolded in four stages, starting with the publication of a clean package as bait, followed by the compromised release of the malicious packages, execution of a dropper script during installation, and finally, the execution of the payload that harvested sensitive data.

How the story developed

All 6 articles
Quiet for 19 weekslast report 22 Jun6 articles6 outlets

6 articles from 6 outlets since 17 Jun. Quiet since 22 Jun. This was the first report.

Now17 Jun181920212223241 NovFirst reportStepSecurity · 17 Jun, 02:10Picked up againafter 4 days quiet
  • Wed 17 Jun, 02:10 UTC. StepSecurity, first report. Malicious npm packages hit Mastra AI, steal credentials.. This article, 1st of 6.
  • Wed 17 Jun, 07:50 UTC. The Hacker News, its first report on the story. Hijacked npm Account Leads to 144 Package Compromise in Mastra.
  • Wed 17 Jun, 08:26 UTC. SecurityOnline, its first report on the story. Supply chain attack compromises 140 npm packages via typosquat.
  • Thu 18 Jun, 05:20 UTC. Microsoft, its first report on the story. Microsoft warns of npm supply chain attack via mastra packages.
  • Mon 22 Jun, 11:30 UTC. SecurityWeek, its first report on the story. North Korean Group Targets NPM Supply Chain, 8M Devs at Risk.
  • Mon 22 Jun, 11:31 UTC. Infosecurity, its first report on the story. North Korean hackers breach Mastra via tainted npm packages.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 6 articles as a list
  1. Wed 17 JunDay 03
    1. Malicious npm packages hit Mastra AI, steal credentials.02:10 · StepSecurity · First report · This article, 1st of 6
    2. Hijacked npm Account Leads to 144 Package Compromise in Mastra07:50 · The Hacker News
    3. Supply chain attack compromises 140 npm packages via typosquat08:26 · SecurityOnline
  2. Thu 18 JunDay 11
    1. Microsoft warns of npm supply chain attack via mastra packages05:20 · Microsoft

  3. Quiet for 4 days

    Mon 22 JunDay 52
    1. North Korean Group Targets NPM Supply Chain, 8M Devs at Risk11:30 · SecurityWeek · Picked up again
    2. North Korean hackers breach Mastra via tainted npm packages11:31 · Infosecurity

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in