Microsoft links Mastra AI supply chain attack to North Korean hackers
Microsoft links North Korean hackers to Mastra AI npm supply chain attack.
Microsoft has attributed a recent supply chain attack targeting over 140 npm packages to the North Korean hacking group Sapphire Sleet (BlueNoroff). The attackers compromised an npm maintainer account to publish malicious updates, injecting a typosquatted dependency that deployed a cross-platform information stealer. This malware targeted cryptocurrency wallets and used various persistence methods across Windows, Linux, and macOS.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonNorth Korean threat actors (Sapphire Sleet/BlueNoroff) compromised a legitimate npm maintainer account to inject malicious code into over 140 widely-used packages, demonstrating how a single compromised identity can propagate malware at scale across an entire software ecosystem. The attackers used typosquatting to disguise a malicious dependency, which deployed a cross-platform information stealer targeting cryptocurrency wallets — a tactic consistent with North Korea's financially motivated cyber operations. This incident highlights the inherent trust risk in open-source dependency chains: developers who consume third-party packages may unknowingly pull in attacker-controlled code. Organizations that lack dependency integrity checks or software composition analysis (SCA) tooling are especially vulnerable, as malicious updates can silently enter production environments through routine package updates.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security monitoring (SIEM)
Logs from everywhere end up in one place, with alerts that someone actually sees.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — easy-day-js
- malware — PowerShell backdoor