Mastra npm Supply Chain Attack Delivers Node.js Implant and PowerShell Backdoor

Microsoft Threat Intelligence has uncovered a massive supply-chain attack on the npm registry, affecting over 140 packages within the Mastra ecosystem.

The campaign relies on a hijacked maintainer account to distribute a malicious typosquat package, which deploys a stealthy Node.js implant and a PowerShell backdoor.

Researchers attribute this highly coordinated attack to Sapphire Sleet, a North Korean state-sponsored threat group notorious for targeting the financial and cryptocurrency sectors.

All compromised packages have been removed from the registry. However, the attack highlights severe risks to developer workstations and continuous integration pipelines.

Mastra NPM Backdoor Attack

The intrusion began when hackers compromised the “ehindero” npm maintainer account, which held publishing rights across the entire Mastra ecosystem.

The attackers used this access to inject the malicious dependency easy-day-js into multiple legitimate Mastra packages.

This rogue package was carefully crafted to impersonate the hugely popular dayjs library, which typically sees over 57 million weekly downloads.

The attackers used a staged delivery pattern, first publishing a clean bait version of the typosquat before pushing a weaponized update just hours later.

Because the malicious code was triggered via an npm post-install hook, developers did not even need to import the package into their code.

Simply running an installation or update command on a compromised version was enough to execute a hidden dropper script named setup.cjs.

This initial script used rotated string arrays and Base64 encoding to hide its true intent from static analysis tools.

Once activated, the dropper immediately disabled TLS certificate verification to mask its traffic, then downloaded a secondary Node.js payload from an attacker-controlled server.

It also dropped hidden tracking files into the operating system’s temporary directory to mark the infection. To maintain access to infected machines, the malware established persistence across multiple operating systems.

It created hidden launch files masquerading as legitimate Node.js protocols using Windows Registry keys, macOS LaunchAgents, and Linux systemd units.

Once embedded, the implant actively hunted for sensitive data, explicitly targeting 166 different cryptocurrency wallet browser extensions, as well as browser histories and detailed system metadata.

For high-value targets, Sapphire Sleet deployed a secondary PowerShell backdoor to gain ultimate control. This script executed anti-forensic cleanup commands to wipe its own command history.

It established SYSTEM-level privileges by creating a malicious Windows service. This service ran automatically at boot, ensuring the attackers retained an interactive, hands-on-keyboard connection to the compromised network.

Microsoft assesses with high confidence that Sapphire Sleet orchestrated this attack primarily to steal cryptocurrency and valuable intellectual property.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.