Skip to main content
Mallory
Back to malware
MalwareUsed by 2 actors

easy-day-js

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
sergey2016

The campaign ... exploited a typosquatting dependency to deliver multi-stage malware ... the only change was a single injected dependency in each manifest: "easy-day-js": "^1.11.21" ... Version 1.11.22, however, added a weaponized postinstall hook running node setup.cjs, executing the malicious payload automatically during npm install.

via cyber security newscybersecuritynews.com
ehindero

The campaign ... exploited a typosquatting dependency to deliver multi-stage malware ... the only change was a single injected dependency in each manifest: "easy-day-js": "^1.11.21" ... Version 1.11.22, however, added a weaponized postinstall hook running node setup.cjs, executing the malicious payload automatically during npm install.

via cyber security newscybersecuritynews.com
MITRE ATT&CK

Techniques & procedures

21 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique
T1589Gather Victim Identity InformationEvidence2

easy-day-js is a deliberate typosquat of the popular dayjs library, published the day prior by a separate account ( sergey2016 ).

Initial Access

4 techniques
T1078Valid AccountsEvidence1

On June 17, 2026, the npm account “ehindero” was hijacked to deliver malware targeting the @mastra organization on npm.

T1195Supply Chain CompromiseEvidence7

An attacker republished the entire @mastra npm scope on June 17, 2026, slipping a single malicious dependency into 142 packages... This attack on an npm package was made possible due to a former contributor account whose scope access was never revoked.

T1195.001Compromise Software Dependencies and Development ToolsEvidence4

A sophisticated supply chain attack has targeted the Mastra-AI npm ecosystem... exploited a typosquatting dependency to deliver multi-stage malware... a single npm account identified as ehindero mass-published malicious versions of 141 @mastra/* packages... the only change was a single injected dependency in each manifest: "easy-day-js": "^1.11.21".

T1566.003Spearphishing via ServiceEvidence2

easy-day-js is a typosquat of the popular dayjs library, published the day before (2026-06-16) by a separate account, sergey2016.

Execution

4 techniques
T1059Command and Scripting InterpreterEvidence1

a subsequent version introduced crypto-stealing logic inside a post-install script.

T1059.007JavaScriptEvidence3

easy-day-js@1.11.22 ships a setup.cjs that runs as a postinstall hook.

T1204.002Malicious FileEvidence3

Any npm install for a compromised @mastra/* package pulls easy-day-js@1.11.22, which runs a postinstall dropper, downloads a cross-platform RAT, installing persistent backdoors on macOS, Linux, and Windows.

T1574.013KernelCallbackTableEvidence1

The "easy-day-js" package launches an obfuscated payload that's fired during a postinstall hook, which acts as a dropper or loader for a second-stage payload retrieved from attacker-controlled infrastructure.

Persistence

2 techniques
T1078Valid AccountsEvidence1

On June 17, 2026, the npm account “ehindero” was hijacked to deliver malware targeting the @mastra organization on npm.

T1546Event Triggered ExecutionEvidence1

Version 1.11.22, however, added a weaponized postinstall hook running node setup.cjs , executing the malicious payload automatically during npm install — before any developer imports or uses the package.

Privilege Escalation

2 techniques
T1078Valid AccountsEvidence1

On June 17, 2026, the npm account “ehindero” was hijacked to deliver malware targeting the @mastra organization on npm.

T1546Event Triggered ExecutionEvidence1

Version 1.11.22, however, added a weaponized postinstall hook running node setup.cjs , executing the malicious payload automatically during npm install — before any developer imports or uses the package.

Stealth

7 techniques
T1027Obfuscated Files or InformationEvidence1

The "easy-day-js" package launches an obfuscated payload that's fired during a postinstall hook...

T1036MasqueradingEvidence4

The attack leverages a typosquatting strategy; the injected dependency, easy-day-js@1.11.22, masquerades as the legitimate dayjs library.

T1070Indicator RemovalEvidence1

Deletes itself to reduce forensic traces.

T1070.004File DeletionEvidence2

Next, it fetches a second-stage payload, runs it as a detached background process, and deletes itself to hide its tracks.

T1078Valid AccountsEvidence1

On June 17, 2026, the npm account “ehindero” was hijacked to deliver malware targeting the @mastra organization on npm.

T1218System Binary Proxy ExecutionEvidence2

Writes it to the temp directory and spawns it as a detached, hidden background process with no console output.

T1574.013KernelCallbackTableEvidence1

The "easy-day-js" package launches an obfuscated payload that's fired during a postinstall hook, which acts as a dropper or loader for a second-stage payload retrieved from attacker-controlled infrastructure.

Discovery

1 technique
T1217Browser Information DiscoveryEvidence1

The final stage is a cross-platform information stealer that can harvest browser history...

Collection

1 technique
T1005Data from Local SystemEvidence1

The recovered second stage is a powerful infostealer. Notably, it steals browser history and raids the stored data of over 160 cryptocurrency wallet extensions.

Command and Control

2 techniques
T1071Application Layer ProtocolEvidence1

downloads and executes a second-stage payload from https://23.254.164.92:8000/update/49890878 ... The argument 23.254.164.123:443 passed as process.argv[2] is almost certainly the stage-2 beacon or command-and-control address.

T1105Ingress Tool TransferEvidence4

Downloads a second-stage payload from https://23.254.164[.]92:8000/update/49890878 ... Writes it to the temp directory and spawns it as a detached, hidden background process.

Exfiltration

1 technique
T1041Exfiltration Over C2 ChannelEvidence2

Stolen data then flows out to the operators’ command-and-control servers.

Other

1 technique
T1562Impair DefensesEvidence3

Disables TLS certificate validation by setting NODE_TLS_REJECT_UNAUTHORIZED='0', so an HTTPS fetch succeeds against a self-signed certificate on a raw IP.

INDICATORS OF COMPROMISE

IOCs tracked for this family

14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
2 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes
5 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other
7 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting
ip.v4●●●●●●●●●●●●View more in apptoday
ip.v4●●●●●●●●●●●●View more in apptoday
uri●●●●●●●●●●●●View more in apptoday
uri●●●●●●●●●●●●View more in apptoday
cidr.v4●●●●●●●●●●●●View more in apptoday
email●●●●●●●●●●●●View more in apptoday
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching14

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping21

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.