{"schema_version":"0.10.0","id":"LR-2026-0588","record_version":1,"title":"Mastra npm packages backdoored in supply chain attack attributed to North Korea","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":56.4,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":4.48,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"Microsoft's own report","original_document":{"url":"https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/","organisation":"Microsoft","role":"company"},"reports_total":2,"reports_independent":2,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"confirmed","reason":"Microsoft's own report"}]},"sources_hash":"2bd5fbe21b80f146a5654bb3f49bc8caadb3bad712bdebb66bb2d4f096787423"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"Building AI agents, multi-step workflows, and retrieval-augmented generation (RAG) pipelines","safeguard_state":null,"production_intended":null},"event":{"date_occurred":"2026-06-17","date_disclosed":"2026-06-17","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"third_party","summary":"A Mastra npm maintainer account was taken over and used to publish poisoned versions of more than 140 packages across the mastra and @mastra scopes, adding easy-day-js, a typosquat of the dayjs library, as a dependency. The poisoned easy-day-js version ran a postinstall hook during npm install that downloaded and launched a second-stage payload. Microsoft Threat Intelligence identified the compromise through anomalous publishing patterns on the mastra package. Microsoft assesses with high confidence that the activity is attributable to Sapphire Sleet, a North Korean state actor. After the findings were shared with the npm security team, the compromised packages were removed and the attacker's publish access was revoked.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":"Compromised packages removed and the attacker's publish access to the @mastra scope revoked","precursor_events":"Clean bait package easy-day-js@1.11.21 published at 07:05 UTC on June 16, 2026","primary_risk":"RK06"},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Major test: many third parties affected, a stated count of 140+ affected packages across the mastra and @mastra scopes, with combined weekly downloads above 1.1 million exposed","harm_class":[],"affected_description":"Developers and CI/CD pipelines that ran npm install and resolved to the compromised Mastra versions","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/","publisher":"Microsoft","date":"2026-06-17","type":"press","title":"From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet - Microsoft","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://www.stepsecurity.io/blog/mastra-npm-packages-compromised-using-easy-day-js","publisher":"Step Security","date":"2026-06-17","type":"press","title":"Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat - Step Security","archived_url":null,"independence":"independent"}],"per_field_confidence":{"system.intended_use":"C","event.date_occurred":"C","event.incident_class":"C","event.adversarial_actor":"C","event.detection_method":"C","event.precursor_events":"C","event.remediation":"C","impact.affected_description":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.intended_use":[{"source_index":1,"quote":"Mastra is a rapidly growing open-source TypeScript framework for building AI agents, multi-step workflows, and retrieval-augmented generation (RAG) pipelines."}],"event.date_occurred":[{"source_index":1,"quote":"On June 17, 2026, an attacker compromised the @mastra npm organization and quietly added easy-day-js as a dependency across 140+ packages in the Mastra AI framework ecosystem."}],"event.incident_class":[{"source_index":0,"quote":"Microsoft Threat Intelligence observed a large-scale npm supply chain attack affecting 140+ packages across the mastra and @mastra scopes on the npm registry."}],"event.adversarial_actor":[{"source_index":0,"quote":"Microsoft assesses with high confidence that this activity is attributable to Sapphire Sleet, a North Korean state actor that primarily targets the financial sector."}],"event.detection_method":[{"source_index":0,"quote":"Microsoft Threat Intelligence identified the compromise through anomalous publishing patterns on the mastra package."}],"event.precursor_events":[{"source_index":0,"quote":"Phase 1 (clean bait): easy-day-js@1.11.21 was published at 07:05 UTC on June 16, 2026."}],"event.remediation":[{"source_index":0,"quote":"Microsoft shared its findings with the npm security team, the compromised packages have been removed and the attacker’s publish access to the @mastra scope has been revoked."}],"impact.affected_description":[{"source_index":0,"quote":"Developers and CI/CD pipelines running npm install automatically resolved to the compromised versions."}],"impact.severity":[{"source_index":1,"quote":"Packages with a combined weekly download count exceeding 1.1 million were exposed."}],"impact.severity_because":[{"source_index":1,"quote":"Packages with a combined weekly download count exceeding 1.1 million were exposed."}],"event.summary":[{"source_index":0,"quote":"Microsoft Threat Intelligence observed a large-scale npm supply chain attack affecting 140+ packages across the mastra and @mastra scopes on the npm registry."},{"source_index":0,"quote":"The compromise originated from the takeover of the ehindero npm maintainer account, which had publish rights across the Mastra ecosystem and was used to publish poisoned package versions that introduced easy-day-js, a malicious typosquat of the popular dayjs library."},{"source_index":0,"quote":"Once installed, easy-day-js triggered a postinstall hook that executed an obfuscated dropper script, disabled Transport Layer Security (TLS) certificate verification, contacted attacker-controlled command-and-control (C2) infrastructure, downloaded a second-stage payload, and executed the payload as a detached hidden process."},{"source_index":0,"quote":"Microsoft Threat Intelligence identified the compromise through anomalous publishing patterns on the mastra package."},{"source_index":0,"quote":"Microsoft assesses with high confidence that this activity is attributable to Sapphire Sleet, a North Korean state actor that primarily targets the financial sector."},{"source_index":0,"quote":"Microsoft shared its findings with the npm security team, the compromised packages have been removed and the attacker’s publish access to the @mastra scope has been revoked."}]},"notes_on_gaps":"The sources do not state a root cause in the closed list, a trigger, or a responsible party, so those fields are omitted. Whether an AI agent was involved is not stated, so agent_involved and failure fields are omitted. The system developer, lifecycle stage, deployment context and country are not stated. Dates for disclosure are not given as a sentence, so date_disclosed is omitted. No direct loss, records exposed, or stated count of affected organisations is given; the 140+ figure counts packages. Reversibility and time to contain are not stated. Step Security's own Harden Runner test reports the stage-2 download blocked in a controlled lab run, which conflicts with Microsoft's account of C2 contact in observed systems; the lab run is not treated as incident evidence. Step Security also refers to 57 packages and 286+ malicious versions in a June 3 campaign, which conflicts with the 140+ packages in the Mastra incident and is not used. Attribution to Sapphire Sleet is Microsoft's high-confidence assessment, not a confirmed fact. Severity major is my judgement from the stated count of 140+ affected packages and 1.1 million weekly downloads exposed. Control outcomes are limited to those the sources tie to this incident; no held controls are stated. Remediation control mappings (J1, G3) are my judgement of the closest control id. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Confirmed (Microsoft's own report)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"The system was the Mastra open-source TypeScript framework for building AI agents, and its npm packages were the target.","quote":"Mastra is a rapidly growing open-source TypeScript framework for building AI agents, multi-step workflows, and retrieval-augmented generation (RAG) pipelines.","source_index":1,"grade":"C"},{"step":"went_wrong","text":"A maintainer account was taken over and used to publish poisoned Mastra versions that added easy-day-js, a typosquat of dayjs, as a dependency.","quote":"The compromise originated from the takeover of the ehindero npm maintainer account, which had publish rights across the Mastra ecosystem and was used to publish poisoned package versions that introduced easy-day-js, a malicious typosquat of the popular dayjs library.","source_index":0,"grade":"C"},{"step":"reached","text":"Developers and CI/CD pipelines that ran npm install resolved to the compromised versions and could run the postinstall hook.","quote":"Developers and CI/CD pipelines running npm install automatically resolved to the compromised versions.","source_index":0,"grade":"C"},{"step":"caught","text":"Microsoft Threat Intelligence identified the compromise through anomalous publishing patterns on the mastra package.","quote":"Microsoft Threat Intelligence identified the compromise through anomalous publishing patterns on the mastra package.","source_index":0,"grade":"C"},{"step":"done","text":"The findings were shared with the npm security team, the compromised packages were removed and the attacker's publish access was revoked.","quote":"Microsoft shared its findings with the npm security team, the compromised packages have been removed and the attacker’s publish access to the @mastra scope has been revoked.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/","https://www.stepsecurity.io/blog/mastra-npm-packages-compromised-using-easy-day-js"]},"analysis":{"sections":{"timeline":[{"text":"Clean bait easy-day-js@1.11.21 published with no payload.","quote":"Phase 1 (clean bait): easy-day-js@1.11.21 was published at 07:05 UTC on June 16, 2026.","source_index":0,"when":"June 16, 2026 07:05 UTC"},{"text":"easy-day-js@1.11.22 published, adding the postinstall hook and setup.cjs payload.","quote":"Phase 2 (weaponization): easy-day-js@1.11.22 was published at 01:01 UTC on June 17, 2026, adding the setup.cjs payload and the postinstall hook.","source_index":0,"when":"June 17, 2026 01:01 UTC"},{"text":"Microsoft Threat Intelligence monitoring observed easy-day-js@1.11.22 at 01:07 UTC and mastra@1.13.1 at 01:28 UTC.","quote":"Microsoft Threat Intelligence monitoring observed easy-day-js@1.11.22 at 01:07 UTC and mastra@1.13.1 at 01:28 UTC on June 17, 2026","source_index":0,"when":"June 17, 2026"},{"text":"Mass republication of 140+ Mastra packages with easy-day-js added as a dependency.","quote":"Over the next 88 minutes, 140+ packages across the entire Mastra ecosystem were republished with easy-day-js quietly added as a production dependency.","source_index":1,"when":"June 17, 2026 01:12–02:39 UTC"},{"text":"Microsoft updated its assessment, attributing the activity to Sapphire Sleet with high confidence.","quote":"June 19, 2026 update: Microsoft assesses with high confidence that this activity is attributable to Sapphire Sleet, a North Korean state actor that primarily targets the financial sector.","source_index":0,"when":"June 19, 2026"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/","https://www.stepsecurity.io/blog/mastra-npm-packages-compromised-using-easy-day-js"]}}