[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZH3OF9yNCPLFXCycorfvgcFeG98KWiKEcgKCkjIyWrA":3},{"article":4,"iocs":54,"watch_terms":61,"solutions":62,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"47bccfd3-f752-41ed-8a06-459ead83f4cc","Microsoft links Mastra AI supply chain attack to North Korean hackers","microsoft-links-mastra-ai-supply-chain-attack-to-north-korean-hackers-2e719d","Microsoft has attributed a recent Mastra AI supply chain attack that compromised more than 140 npm packages to the North Korean hacking group Sapphire Sleet, also known as BlueNoroff. [...]","Microsoft has attributed a recent supply chain attack targeting over 140 npm packages to the North Korean hacking group Sapphire Sleet (BlueNoroff). The attackers compromised an npm maintainer account to publish malicious updates, injecting a typosquatted dependency that deployed a cross-platform information stealer. This malware targeted cryptocurrency wallets and used various persistence methods across Windows, Linux, and macOS.","Microsoft links North Korean hackers to Mastra AI npm supply chain attack.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fmicrosoft-links-mastra-ai-supply-chain-attack-to-north-korean-hackers\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2023\u002F11\u002F07\u002FNorth_Korean_hackers.jpg","2026-06-20T14:09:19+00:00","2026-06-20T16:00:24.240074+00:00",9,[17,20,22,25,28],{"name":18,"type":19},"Sapphire Sleet","threat_actor",{"name":21,"type":19},"BlueNoroff",{"name":23,"type":24},"Microsoft","vendor",{"name":26,"type":27},"npm","technology",{"name":29,"type":30},"Axios","product","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":31,"icon":33,"name":34,"slug":35},null,"Supply Chain","supply-chain",[37,39,44,49],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,58],{"type":48,"value":56,"context":57},"easy-day-js","Malicious dependency injected into @mastra npm packages.",{"type":48,"value":59,"context":60},"PowerShell backdoor","Used by Sapphire Sleet in follow-on activity.",[23,29],{"controls":63,"vendors":141},[64,92,114],{"slug":65,"name":66,"problem":67,"products":68},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[69,76,84],{"vendor_slug":70,"vendor_name":23,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":93,"name":94,"problem":95,"products":96},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[97,105,106],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"vega","Vega","\u002Fvendor-logos\u002Fvega.png","vega-agentic-detection","Agentic Detection","https:\u002F\u002Fvega.io\u002Fplatform\u002Fagentic-detection","Detection rules that run across security data in the stores where it already lives, so logs do not have to be moved into a central SIEM first.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"abstract-security","Abstract Security","\u002Fvendor-logos\u002Fabstract-security.png","abstract-composable-siem","Abstract Composable SIEM","https:\u002F\u002Fwww.abstract.security\u002Fplatform","SIEM built from separate parts for collection, AI-assisted detection and tiered retention, which can be adopted one at a time.",{"slug":115,"name":116,"problem":117,"products":118},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[119,125,133],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":120,"product_name":121,"url":123,"description":124},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",[142],{"slug":70,"name":23,"logo_path":71,"roles":143},[144],"reported_by",{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":162},"north-korean-hackers-poison-npm-packages-in-mastra-ai-supply-chain-attack","North Korean Hackers Poison npm Packages in Mastra AI Supply Chain Attack","North Korean threat actors (Sapphire Sleet\u002FBlueNoroff) compromised a legitimate npm maintainer account to inject malicious code into over 140 widely-used packages, demonstrating how a single compromised identity can propagate malware at scale across an entire software ecosystem. The attackers used typosquatting to disguise a malicious dependency, which deployed a cross-platform information stealer targeting cryptocurrency wallets — a tactic consistent with North Korea's financially motivated cyber operations. This incident highlights the inherent trust risk in open-source dependency chains: developers who consume third-party packages may unknowingly pull in attacker-controlled code. Organizations that lack dependency integrity checks or software composition analysis (SCA) tooling are especially vulnerable, as malicious updates can silently enter production environments through routine package updates.",[150,151,152,153,154,155,156,157,158,159,160,161],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 6: Access Control Management","CIS Control 16: Application Software Security","NIST SP 800-161: Cybersecurity Supply Chain Risk Management","NIST SP 800-218 (SSDF): Secure Software Development Framework","NIST AC-2: Account Management","NIST SA-12: Supply Chain Protection","NIST SI-7: Software, Firmware, and Information Integrity","SLSA Framework: Supply-chain Levels for Software Artifacts","NIST CSF: ID.SC-4 (Supply Chain Risk Management)","GDPR Article 32: Security of processing (relevant if PII exfiltrated)","ITIL: Change Management — unauthorized change detection",{}]