package-repository-poisoningdependency-confusion-typosquatcredential-stealer-activityvendor-distribution-compromise

Hijacked Mastra npm Account Spread easy-day-js Info-Stealer to 144 Packages

Supply Chain Risk · 33 sources · Updated 3mo ago · First seen Jun 17, 2026

A software supply chain attack compromised up to 144 @mastra/* npm packages after an attacker abused lingering publish access on a former contributor account and pushed tainted releases into the widely used JavaScript and TypeScript AI framework ecosystem. The malicious package versions did not contain the payload directly; instead, they added a dependency on easy-day-js, a typosquatted package impersonating the legitimate dayjs library. Investigators said the attacker first published a benign-looking easy-day-js@1.11.21, then followed with malicious easy-day-js@1.11.22 before releasing compromised Mastra packages that referenced the permissive version range ^1.11.21, allowing the harmful dependency to be pulled in during installation.

Does this reach your builds?Trace attribution and downstream blast radius.

Trace the chain

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

7 events · Jun 16, 2026 – Jun 20, 2026

Jun 20, 20264mo ago
Microsoft attributes Mastra npm compromise to Sapphire Sleet
A Microsoft security blog linked in the new reference attributed the Mastra npm supply chain compromise to Sapphire Sleet. This adds a named threat actor assessment to the previously reported easy-day-js and compromised @mastra package activity.
Post by @lazarusholic.bsky.social - Bluesky
Jun 17, 20264mo ago
npm removes malicious package versions and reverts latest tags
Following the discovery, npm removed malicious versions from the most prominent affected packages and reverted their latest tags. Defenders advised users who installed the affected versions to treat hosts as potentially compromised, roll back packages, rotate credentials, and investigate for artifacts.
144 Mastra npm Packages Compromised via Hijacked Contributor Account
Jun 17, 20264mo ago
Mastra disables token publishing and mandates MFA for npm publishes
In response to the npm compromise, Mastra disabled token-based npm publishing and required multi-factor authentication for all publishes. The change was announced alongside guidance for users to audit dependencies, inspect logs, update to clean versions, and rotate credentials on affected systems.
Mastra AI Hit By npm Compromise - Decipher
Jun 17, 20264mo ago
Mastra removes unauthorized owner and publishes clean replacement releases
After the @mastra npm scope compromise, Mastra removed the unauthorized owner account used in the attack and published clean forward-rolled package releases to replace the compromised versions. The report also noted the source repository was not modified and the malicious dependency was inserted during package publishing.
Mastra npm Scope Takeover | Snyk
Jun 17, 20264mo ago
Researchers disclose the easy-day-js supply chain attack
Researchers reported a software supply chain attack dubbed easy-day-js affecting up to 144 npm packages in the @mastra/* namespace. Their analysis described the malicious dependency chain, the obfuscated loader behavior, and the final payload's information-stealing capabilities.
144 Mastra npm Packages Compromised via Hijacked Contributor Account
Jun 17, 20264mo ago
Malicious easy-day-js and compromised @mastra packages are published
On 2026-06-17, an attacker using access to the @mastra npm organization published malicious Mastra package versions that added a dependency on easy-day-js@1.11.22. The malicious package used a postinstall hook to fetch and run a second-stage payload, and the activity was tied to a hijacked contributor account with lingering publish access.
Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat - StepSecurity
Jun 16, 20264mo ago
Attacker publishes benign easy-day-js@1.11.21 to npm
The attacker first published a benign-looking easy-day-js version 1.11.21, apparently to establish credibility before the malicious stage of the campaign. This package later served as the dependency name used in compromised Mastra releases.
Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat - StepSecurity

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Malware

1 linked

easy-day-js

Organizations

1 linked

Mastra

Breaches

3 linked

MASTRA-2026-06MASTRAAI-2026-06MASTRAAIFRAMEWORK-2026-06

Observables

26 linked

SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

URLhttps://••••••.•••/•••••Domain••••••••.comIPv4 address•••.•••.••.•••Email address••••••••@•••••.•••IPv4 range•••.•••.•••.0/21SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

URLhttps://••••••.•••/•••••••+18

Indicator values are masked on this page. View all 26 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?See attribution and downstream blast radius, and whether this package or vendor reaches your builds.

Trace the Supply Chain

Source coverage

Sources

33 references tracked. Mallory keeps watching after this page renders.

Aikido Dev BlogNews · Jun 25, 2026

Everybody's shipping code they can't readOpen source ↗

Infosecurity Magazine NewsNews · Jun 22, 2026

Microsoft Attributes Mastra AI Supply Chain Attack to North Korea - Infosecurity MagazineOpen source ↗

Security WeekNews · Jun 22, 2026

North Korean Hackers Blamed for Mastra NPM Supply Chain Attack - SecurityWeekOpen source ↗

Cyber Security NewsNews · Jun 22, 2026

North Korean Hackers Abuse Mastra npm Supply Chain to Target Developers and CI/CD Pipelines - Cyber Security NewsOpen source ↗

25 additional sources from 17-06-2026 to 22-06-2026

Snyk BlogNews · Jun 16, 2026

Mastra npm Scope Takeover | SnykOpen source ↗

Jfrog ResearchNews · Jun 16, 2026

easy-day-js: Supply Chain Campaign Targets Mastra npm Packages - JFrog Security ResearchOpen source ↗

Flareio BlogNews · Jun 14, 2026

Supply chain ransomware: TeamPCP weaponizes worms to fuel partnershipsOpen source ↗

Linkedin Posts WebNews · Jan 1, 2026

Microsoft has identified a supply chain attack on the Mastra-AI npm ecosystem, with 80+ packages compromised through npm account takeover. The attacker introduced a phantom dependency into the… | Microsoft Threat IntelligenceOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

package-repository-poisoningdependency-confusion-typosquatcredential-stealer-activityvendor-distribution-compromise

Hijacked Mastra npm Account Spread easy-day-js Info-Stealer to 144 Packages

Supply Chain Risk · 33 sources · Updated 3mo ago · First seen Jun 17, 2026

Does this reach your builds?Trace attribution and downstream blast radius.

Trace the chain

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

7 events · Jun 16, 2026 – Jun 20, 2026

Jun 20, 20264mo ago
Microsoft attributes Mastra npm compromise to Sapphire Sleet
A Microsoft security blog linked in the new reference attributed the Mastra npm supply chain compromise to Sapphire Sleet. This adds a named threat actor assessment to the previously reported easy-day-js and compromised @mastra package activity.
Post by @lazarusholic.bsky.social - Bluesky
Jun 17, 20264mo ago
npm removes malicious package versions and reverts latest tags
Following the discovery, npm removed malicious versions from the most prominent affected packages and reverted their latest tags. Defenders advised users who installed the affected versions to treat hosts as potentially compromised, roll back packages, rotate credentials, and investigate for artifacts.
144 Mastra npm Packages Compromised via Hijacked Contributor Account
Jun 17, 20264mo ago
Mastra disables token publishing and mandates MFA for npm publishes
In response to the npm compromise, Mastra disabled token-based npm publishing and required multi-factor authentication for all publishes. The change was announced alongside guidance for users to audit dependencies, inspect logs, update to clean versions, and rotate credentials on affected systems.
Mastra AI Hit By npm Compromise - Decipher
Jun 17, 20264mo ago
Mastra removes unauthorized owner and publishes clean replacement releases
After the @mastra npm scope compromise, Mastra removed the unauthorized owner account used in the attack and published clean forward-rolled package releases to replace the compromised versions. The report also noted the source repository was not modified and the malicious dependency was inserted during package publishing.
Mastra npm Scope Takeover | Snyk
Jun 17, 20264mo ago
Researchers disclose the easy-day-js supply chain attack
Researchers reported a software supply chain attack dubbed easy-day-js affecting up to 144 npm packages in the @mastra/* namespace. Their analysis described the malicious dependency chain, the obfuscated loader behavior, and the final payload's information-stealing capabilities.
144 Mastra npm Packages Compromised via Hijacked Contributor Account
Jun 17, 20264mo ago
Malicious easy-day-js and compromised @mastra packages are published
On 2026-06-17, an attacker using access to the @mastra npm organization published malicious Mastra package versions that added a dependency on easy-day-js@1.11.22. The malicious package used a postinstall hook to fetch and run a second-stage payload, and the activity was tied to a hijacked contributor account with lingering publish access.
Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat - StepSecurity
Jun 16, 20264mo ago
Attacker publishes benign easy-day-js@1.11.21 to npm
The attacker first published a benign-looking easy-day-js version 1.11.21, apparently to establish credibility before the malicious stage of the campaign. This package later served as the dependency name used in compromised Mastra releases.
Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat - StepSecurity

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Malware

1 linked

easy-day-js

Organizations

1 linked

Mastra

Breaches

3 linked

MASTRA-2026-06MASTRAAI-2026-06MASTRAAIFRAMEWORK-2026-06

Observables

26 linked

SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

URLhttps://••••••.•••/•••••••+18

Indicator values are masked on this page. View all 26 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?See attribution and downstream blast radius, and whether this package or vendor reaches your builds.

Trace the Supply Chain

Source coverage

Sources

33 references tracked. Mallory keeps watching after this page renders.

Aikido Dev BlogNews · Jun 25, 2026

Everybody's shipping code they can't readOpen source ↗

Infosecurity Magazine NewsNews · Jun 22, 2026

Microsoft Attributes Mastra AI Supply Chain Attack to North Korea - Infosecurity MagazineOpen source ↗

Security WeekNews · Jun 22, 2026

North Korean Hackers Blamed for Mastra NPM Supply Chain Attack - SecurityWeekOpen source ↗

Cyber Security NewsNews · Jun 22, 2026

North Korean Hackers Abuse Mastra npm Supply Chain to Target Developers and CI/CD Pipelines - Cyber Security NewsOpen source ↗

25 additional sources from 17-06-2026 to 22-06-2026

Snyk BlogNews · Jun 16, 2026

Mastra npm Scope Takeover | SnykOpen source ↗

Jfrog ResearchNews · Jun 16, 2026

easy-day-js: Supply Chain Campaign Targets Mastra npm Packages - JFrog Security ResearchOpen source ↗

Flareio BlogNews · Jun 14, 2026

Supply chain ransomware: TeamPCP weaponizes worms to fuel partnershipsOpen source ↗

Linkedin Posts WebNews · Jan 1, 2026

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Hijacked Mastra npm Account Spread easy-day-js Info-Stealer to 144 Packages

How this story unfolded

Microsoft attributes Mastra npm compromise to Sapphire Sleet

npm removes malicious package versions and reverts latest tags

Mastra disables token publishing and mandates MFA for npm publishes

Mastra removes unauthorized owner and publishes clean replacement releases

Researchers disclose the easy-day-js supply chain attack

Malicious easy-day-js and compromised @mastra packages are published

Attacker publishes benign easy-day-js@1.11.21 to npm

Related entities

Malware

Organizations

Breaches

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

Malicious NPM Packages Targeting the JavaScript Supply Chain

Automated Supply Chain Campaign Flooded npm With 800 Malicious Packages

Compromised npm Maintainer Account Spread Credential-Stealing Malware Across AntV and timeago.js

Hijacked Mastra npm Account Spread easy-day-js Info-Stealer to 144 Packages

How this story unfolded

Microsoft attributes Mastra npm compromise to Sapphire Sleet

npm removes malicious package versions and reverts latest tags

Mastra disables token publishing and mandates MFA for npm publishes

Mastra removes unauthorized owner and publishes clean replacement releases

Researchers disclose the easy-day-js supply chain attack

Malicious easy-day-js and compromised @mastra packages are published

Attacker publishes benign easy-day-js@1.11.21 to npm

Related entities

Malware

Organizations

Breaches

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

Malicious NPM Packages Targeting the JavaScript Supply Chain

Automated Supply Chain Campaign Flooded npm With 800 Malicious Packages

Compromised npm Maintainer Account Spread Credential-Stealing Malware Across AntV and timeago.js