AI Risk Wire

Cases › security breach › LR-2026-0588

Mastra npm packages backdoored in supply chain attack attributed to North Korea

Confirmed Why: Microsoft's own report · Microsoft · 2 independent reports

Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.

Status: fix reported

Severity major
Reported 17 Jun 2026

No source states: loss or records, developer and model, agent tool, could do, deployer, industry.

Severity major: test: many third parties affected, a stated count of 140+ affected packages across the mastra and @mastra scopes, with combined weekly downloads above 1.1 million exposed

A Mastra npm maintainer account was taken over and used to publish poisoned versions of more than 140 packages across the mastra and @mastra scopes, adding easy-day-js, a typosquat of the dayjs library, as a dependency. The poisoned easy-day-js version ran a postinstall hook during npm install that downloaded and launched a second-stage payload. Microsoft Threat Intelligence identified the compromise through anomalous publishing patterns on the mastra package. Microsoft assesses with high confidence that the activity is attributable to Sapphire Sleet, a North Korean state actor. After the findings were shared with the npm security team, the compromised packages were removed and the attacker's publish access was revoked.

What happened

1 · What it was doingThe system was the Mastra open-source TypeScript framework for building AI agents, and its npm packages were the target.
2 · What went wrongA maintainer account was taken over and used to publish poisoned Mastra versions that added easy-day-js, a typosquat of dayjs, as a dependency.
3 · What it reached or didDevelopers and CI/CD pipelines that ran npm install resolved to the compromised versions and could run the postinstall hook.
4 · How it was caughtMicrosoft Threat Intelligence identified the compromise through anomalous publishing patterns on the mastra package.

What was done

The findings were shared with the npm security team, the compromised packages were removed and the attacker's publish access was revoked.
Fix reported

“Compromised packages removed and the attacker's publish access to the @mastra scope revoked”

Risks

Supply-chain compromise
Primary24 incidents
Rising: 4 vs 0.2 a week

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Harness

Sandboxed code execution

Application

Signed and verified components · Vetting of plug-ins, skills and dependencies · AI bill of materials · Vulnerability scanning of AI components · Model provenance checks · Least-privilege access for the agent

Infrastructure / target

Secrets scanning

Evidence

No source states: when it was found, how many records were exposed, the direct loss, any court case, the cause, what set it off.

Show the full account: 2 items from the primary sources

What happened, in order

  1. June 17, 2026 01:12–02:39 UTC Mass republication of 140+ Mastra packages with easy-day-js added as a dependency.
  2. June 19, 2026 Microsoft updated its assessment, attributing the activity to Sapphire Sleet with high confidence.
Show every field, with its source and grade

The AI system

What it was for
Building AI agents, multi-step workflows, and retrieval-augmented generation (RAG) pipelines
C one secondary source states it

What happened

When it happened
2026-06-17
C one secondary source states it
Who caught it
an outside party
C one secondary source states it
Who caused it
an outside attacker
C one secondary source states it
What was done
Compromised packages removed and the attacker's publish access to the @mastra scope revoked
C one secondary source states it
Earlier warning signs
Clean bait package easy-day-js@1.11.21 published at 07:05 UTC on June 16, 2026
C one secondary source states it
What went wrong
security breach
C one secondary source states it
primary risk
RK06
D inferred by us from the described behaviour, reason shown

Impact

Severity
major
D inferred by us from the described behaviour, reason shown
Who was affected
Developers and CI/CD pipelines that ran npm install and resolved to the compromised Mastra versions
C one secondary source states it
Why this severity
test: many third parties affected, a stated count of 140+ affected packages across the mastra and @mastra scopes, with combined weekly downloads above 1.1 million exposed
D inferred by us from the described behaviour, reason shown

Notes on gaps

Attribution to Sapphire Sleet is Microsoft's high-confidence assessment, not a confirmed fact. Control outcomes are limited to those the sources tie to this incident; no held controls are stated.

LR-2026-0588 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON