Sapphire Sleet Backdoors 144 npm Packages in 88 Minutes to Steal Cryptocurrency Wallets

The attack exploited a fundamental trust relationship in the npm ecosystem: developers and automated CI/CD pipelines implicitly execute any code defined in a package's postinstall script during installation without prompting. Sapphire Sleet weaponized this trust by compromising the ehindero maintainer account and inserting easy-day-js as a dependency into 144 packages across the @mastra scope in a window of 19 minutes.

The postinstall hook ran node setup.cjs --no-warnings, executing a 4,572-byte obfuscated JavaScript dropper. The dropper used rotated string arrays and base64 decoding to resist static analysis, disabled TLS certificate verification by setting NODE_TLS_REJECT_UNAUTHORIZED to 0, and created tracking marker files at $TMPDIR/.pkg_history and $TMPDIR/.pkg_logs to prevent reinfection of already-compromised hosts. On first execution, it connected to 23.254.164.92:8000 and downloaded a 41 KB Node.js tasking client.

The second-stage payload supported Windows, macOS, and Linux. On Windows, it injected a reflective .NET DLL into cmd.exe, added Windows Defender exclusions for C:\Windows\System32, deleted PowerShell command history, and set a registry run key for persistence. On macOS, it installed a LaunchAgent plist at ~/Library/NodePackages/com.nvm.protocal.plist. On Linux, it created a systemd user unit at ~/.config/systemd/nvmconf/nvmconf.service. Across all platforms, the payload polled maskasd.com for attacker commands every 10 seconds, providing Sapphire Sleet operators with interactive shell access to any compromised host.

The dropper's stage one ran in every environment that executed npm install, including developer laptops and cloud-hosted CI/CD runners. Any secrets, tokens, environment variables, or API keys accessible in those environments were exposed to an attacker-controlled command-and-control channel within seconds of installation.

The compromised packages span the entire @mastra scope. Any package that declared easy-day-js as a dependency and was published or updated between June 17, 01:01 UTC and npm's takedown response is poisoned. The core package mastra@1.13.1 carries the malicious dependency and represents the highest-download vector into developer environments. All packages in the @mastra/* namespace published in that window share the same risk profile.

Developers should run npm ls easy-day-js in every project that references @mastra packages. Any output listing easy-day-js@1.11.22 confirms the postinstall hook had the opportunity to execute during installation. Note that the hook executes at install time, not at runtime: the presence of the package in the dependency tree does not mean the malware is still running, but it does confirm the dropper ran during the install session.

Teams should also check for the file SHA-256 hash B122A9873BEDF145AE2A7FD024B5F309007DBB025149F4DC4AC3F7E4F32A36A4 against any setup.cjs files in their npm cache. The mastra-1.13.1.tgz package archive carries hash B73DE25C053C3225A077738A1FCBD9CA6966D7B3CD6F5494A30F0AA0EAE55C7E, which can be verified against package integrity records.

Safe pinning points confirmed by Microsoft: mastra at version 1.13.0 or earlier, and @mastra/core at version 1.42.0 or earlier. Organizations should update package.json files to use exact versions rather than semver ranges for core infrastructure dependencies in any AI or financial application built on Mastra.

Sapphire Sleet operates under the broader North Korean Lazarus Group umbrella, focused specifically on cryptocurrency theft to fund North Korea's weapons programs. Microsoft tracks them as one of the most financially destructive North Korean sub-groups, with prior campaigns netting hundreds of millions in cryptocurrency from exchanges, venture capital firms, and individual investors.

The April 2026 Axios npm compromise used the same postinstall hook technique: modified versions of the Axios HTTP library: one of the most widely used Node.js HTTP clients: pointed to a phantom dependency designed to download and execute a cross-platform remote access trojan. That campaign established that Sapphire Sleet had developed and refined the npm attack playbook before targeting Mastra. The two campaigns share infrastructure fingerprints, including the same dropper obfuscation pattern and the same C2 communication protocol.

The Mastra attack represents a strategic escalation. Rather than targeting a generic utility library used across millions of unrelated projects, Sapphire Sleet identified a framework with a defined enterprise customer base concentrated in financial services and cryptocurrency development. This precision increases the probability that a compromised developer workstation holds cryptocurrency wallet credentials or API keys to financial platforms. Sapphire Sleet's TTPs in this campaign map to MITRE ATT&CK T1195.002 (Compromise Software Supply Chain), T1546.004 (Unix Shell Configuration Modification), and T1059.001 (PowerShell), consistent with their broader pattern covered in our analysis of the BlueNoroff deepfake Zoom ClickFix campaign.

The tooling, infrastructure choices, and victim selection in the April and June 2026 npm campaigns both show heavy weighting toward organizations in NATO member countries and cryptocurrency-adjacent development teams.

The highest-risk population is any development team that ran npm install on a project referencing @mastra packages between June 17, 01:20 UTC and npm's takedown. The attack reached every major operating system, meaning Windows developers, macOS developers, and Linux-based CI/CD runners all face identical risk.

Developer workstations with cryptocurrency wallet browser extensions installed face direct financial exposure. The second-stage payload hardcoded 166 wallet extension IDs covering MetaMask, Phantom, Coinbase Wallet, Binance Wallet, TronLink, and every other major browser-accessible wallet for Chrome, Edge, and Brave. The payload collected wallet extension data alongside browser history SQLite databases, giving Sapphire Sleet operators a complete picture of a developer's cryptocurrency holdings and trading platforms.

CI/CD pipeline runners carry a different but equally serious risk. Any secrets, environment variables, API keys, or deployment tokens accessible in a build environment that installed poisoned Mastra packages were exposed to a 10-second callback loop providing interactive shell access. Cloud-hosted runners on GitHub Actions, GitLab CI, and similar platforms that use ephemeral containers mitigate persistence but do not prevent secrets exfiltration during the compromised install session.

Enterprise risk extends to any downstream application built on Mastra. Financial services companies and fintech startups using Mastra's AI orchestration layer in customer-facing products may have had build-time credentials for production environments exposed. The group's prior campaign infrastructure choices in the North Korea 1,700-package supply chain attack demonstrate a consistent interest in credentials that provide access to financial platforms beyond the individual developer's personal accounts.

Detection begins with dependency auditing and expands to filesystem, registry, and network telemetry depending on what the audit finds.

In dependency trees, search for easy-day-js@1.11.22 in package-lock.json files and node_modules directories across all projects using @mastra packages. Run npm ls easy-day-js in any Mastra-dependent project. The presence of the entry confirms the postinstall hook had the opportunity to execute.

On the filesystem, check for $TMPDIR/.pkg_history and $TMPDIR/.pkg_logs on Linux and macOS. On Windows, look for C:\ProgramData\system.bat, an unexpected hidden batch file created by the second-stage payload, and the malicious DLL scdev.dll in the system directory.

In the network layer, look for outbound connections to 23.254.164.92 and 23.254.164.123, the primary C2 IPs, and DNS lookups for maskasd.com and teams.onweblive.org. Any connection to these endpoints from a developer workstation or CI/CD runner confirms active backdoor communication.

In Windows registry, check HKCU\Software\Microsoft\Windows\CurrentVersion\Run for unexpected entries launching hidden PowerShell. On macOS, look for ~/Library/NodePackages/com.nvm.protocal.plist. On Linux, inspect ~/.config/systemd/nvmconf/nvmconf.service.

Act immediately if your team installed any @mastra packages on or after June 17, 2026. The remediation sequence below addresses the infection chain from dependency removal through persistence cleanup and credential rotation.

Start with the dependency audit before touching anything else. Running npm install again on a still-poisoned tree reinfects cleaned machines.

The Mastra campaign is not an edge case in the North Korean threat actor playbook. It is the third confirmed Sapphire Sleet npm operation in 2026, following the 1,700-package campaign and the Axios compromise, demonstrating a mature, repeatable capability running as an ongoing revenue operation.

No zero-day vulnerability enabled this attack. No patch exists because the attack exploited the npm ecosystem's trust model, not a software bug. The risk exists for every organization that installs open-source npm packages without verifying maintainer account security, reviewing postinstall scripts, or using lockfile-based installs with the --ignore-scripts flag. That describes the vast majority of software development teams.

What makes the Sapphire Sleet attack surface distinct from generic supply chain risk is the targeting precision. The 166-wallet extension enumeration list, the financial sector victim weighting, and the April-to-June operational tempo point to a dedicated team treating npm supply chain attacks as a systematic revenue channel. The group's prior campaigns covered in our analysis of the TanStack supply chain attack targeting developer credentials and the North Korea 1,700-package operation demonstrate consistent escalation in both scale and sector focus.

Every development team using AI orchestration frameworks, JavaScript toolchains, or open-source npm dependencies in financial services applications is operating in Sapphire Sleet's target environment. The remediation steps above address the immediate threat. The structural fix requires enforcing --ignore-scripts in all CI/CD pipelines, adopting software composition analysis tooling that flags typosquatted packages, and treating npm maintainer account security with the same rigor applied to production infrastructure credentials.