Microsoft has attributed the June 17 Mastra supply chain attack to Sapphire Sleet, a North Korean state-sponsored threat actor. During the incident, attackers published 141 malicious packages targeting cryptocurrency wallets.

The attack involved compromising the NPM maintainer account 'ehindero', which held publishing rights across the Mastra ecosystem. Within a 45-minute window, the attackers published 141 malicious packages containing a dependency identified as 'easy-day-js'. This dependency is a typosquat of the legitimate 'dayjs' date library. One day prior to the account takeover, a clean version of 'easy-day-js' was published to a separate account named 'sergey2016'.

According to Microsoft, the malicious dependency executed an obfuscated postinstall dropper script that disabled Transport Layer Security (TLS) certificate verification. The dropper then connected with attacker-controlled command-and-control infrastructure to download a second-stage payload. The second-stage payload executed as a detached, hidden background process. Microsoft stated that the malware targeted Windows, macOS, and Linux systems.

The malware collected system information, browser histories, installed applications, and running processes. It also checked for the installation of 166 cryptocurrency wallet browser extensions, including MetaMask, Phantom, Coinbase Wallet, Binance Wallet, and TronLink. The affected Mastra packages have approximately 8 million weekly downloads. Mastra is an open-source TypeScript framework for building AI agents, workflows, and RAG pipelines.

"Microsoft assesses with high confidence that this activity is attributable to Sapphire Sleet, a North Korean state actor that primarily targets the financial sector," the technology company said. Microsoft noted that systems communicating with the attackers' command-and-control servers showed follow-on activity associated with the group. This activity included the deployment of a PowerShell backdoor, additional persistence mechanisms, Microsoft Defender exclusions, and a malicious Windows service granting SYSTEM privileges. Cybersecurity firms Aikido, Ox, Socket, Sonatype, and StepSecurity have published technical details regarding the attack.

"Because the payload executes during installation, any developer workstation or continuous integration and continuous delivery (CI/CD) pipeline that ran npm install or npm update after the compromised versions were published was potentially exposed, regardless of whether the package was imported in application code," Microsoft said. The company stated that once installed, easy-day-js triggered a postinstall hook that executed an obfuscated dropper script, disabled TLS verification, contacted attacker-controlled command-and-control infrastructure, downloaded a second-stage payload, and executed the payload as a detached hidden process.