[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fO7lQCpgW2OcMShZDtjqL0_5vCKzPWhvYgzZL3lDWJBo":3},{"article":4,"iocs":55,"watch_terms":62,"solutions":63,"lesson":155},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"74eddf9b-256e-42fe-8b23-c64824291f33","From package to postinstall payload: Inside the Mastra npm supply chain compromise","from-package-to-postinstall-payload-inside-the-mastra-npm-supply-chain-compromis-9658f0","A poisoned npm package infected 140+ projects with a hidden payload. This report highlights how to detect, hunt, and defend against supply chain attacks using Microsoft Defender and actionable threat intelligence. The post From package to postinstall payload: Inside the Mastra npm supply chain compromise appeared first on Microsoft Security Blog.","A large-scale npm supply chain attack compromised over 140 packages within the Mastra ecosystem by taking over a maintainer account. The attacker introduced a malicious typosquat package, 'easy-day-js', which, upon installation, executed a dropper script disabling TLS verification and downloading a second-stage payload. This attack potentially exposed developer workstations and CI\u002FCD pipelines.","Mastra npm supply chain attack poisoned 140+ packages with malicious payload via account takeover.","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F06\u002F17\u002Fpostinstall-payload-inside-mastra-npm-supply-chain-compromise\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Fwp-content\u002Fuploads\u002F2026\u002F03\u002FMS_Actional-Insights_Malware-ransomware-1.jpg","2026-06-18T03:43:04+00:00","2026-06-18T06:01:47.090251+00:00",9,[17,20,22,24,27,29],{"name":18,"type":19},"npm","product",{"name":21,"type":19},"easy-day-js",{"name":23,"type":19},"dayjs",{"name":25,"type":26},"postinstall hook","technology",{"name":28,"type":26},"TLS certificate verification",{"name":30,"type":31},"Microsoft","vendor","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":32,"icon":34,"name":35,"slug":36},null,"Supply Chain","supply-chain",[38,40,45,50],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,58],{"type":44,"value":21,"context":57},"Malicious typosquat package impersonating 'dayjs'.",{"type":59,"value":60,"context":61},"domain","tutamail.com","Anonymous email service used by the attacker.",[30,18,21],{"controls":64,"vendors":149},[65,94,123],{"slug":66,"name":67,"problem":68,"products":69},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"slug":95,"name":96,"problem":97,"products":98},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":124,"name":125,"problem":126,"products":127},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[128,136,144],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":145,"product_name":146,"url":147,"description":148},"jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",[150],{"slug":151,"name":30,"logo_path":152,"roles":153},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[154],"reported_by",{"slug":156,"title":157,"body":158,"framework_refs":159,"framework_notes":170},"mastra-npm-ecosystem-compromised-via-maintainer-account-takeover","Mastra npm Ecosystem Compromised via Maintainer Account Takeover","Attackers gained control of a legitimate npm maintainer account and injected malicious code into over 140 packages within the Mastra ecosystem, demonstrating how a single compromised identity can have cascading downstream effects. The attack leveraged a typosquat package ('easy-day-js') that disabled TLS verification and fetched a second-stage payload, meaning developers and CI\u002FCD pipelines silently executed attacker-controlled code upon package installation. This matters because modern software development heavily trusts the open-source package ecosystem, and a compromised maintainer account bypasses most traditional security controls. The disabling of TLS verification is particularly dangerous as it opens the door to further man-in-the-middle attacks and credential theft on developer workstations.",[160,161,162,163,164,165,166,167,168,169],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 6: Access Control Management","CIS Control 16: Application Software Security","NIST SP 800-161: Supply Chain Risk Management","NIST AC-2: Account Management","NIST SI-3: Malicious Code Protection","NIST SR-11: Component Authenticity","SLSA Supply Chain Levels for Software Artifacts (Level 2+)","SSDF (NIST SP 800-218) PW.4: Reuse Well-Secured Software","GDPR Article 32: Security of Processing (where developer data may be exfiltrated)",{}]