[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDAoI32_krtioq53vpFDGdCMMhJgteqda17gCddLNOMA":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":63},"00807b35-1540-414c-86b2-0f2f3173fb58","north-korean-hackers-poison-npm-packages-in-mastra-ai-supply-chain-attack","47bccfd3-f752-41ed-8a06-459ead83f4cc","North Korean Hackers Poison npm Packages in Mastra AI Supply Chain Attack","North Korean threat actors (Sapphire Sleet\u002FBlueNoroff) compromised a legitimate npm maintainer account to inject malicious code into over 140 widely-used packages, demonstrating how a single compromised identity can propagate malware at scale across an entire software ecosystem. The attackers used typosquatting to disguise a malicious dependency, which deployed a cross-platform information stealer targeting cryptocurrency wallets — a tactic consistent with North Korea's financially motivated cyber operations. This incident highlights the inherent trust risk in open-source dependency chains: developers who consume third-party packages may unknowingly pull in attacker-controlled code. Organizations that lack dependency integrity checks or software composition analysis (SCA) tooling are especially vulnerable, as malicious updates can silently enter production environments through routine package updates.","**Immediate actions:**\n- Audit all npm dependencies in your projects for unexpected updates published in the past 90 days and cross-reference against known malicious package lists.\n- Enable multi-factor authentication (MFA) on all package registry accounts (npm, PyPI, etc.) to prevent account-takeover-based supply chain attacks.\n- Pin dependency versions in `package-lock.json` or equivalent lockfiles and verify package integrity using checksums before deployment.\n\n**Long-term improvements:**\n- Integrate a Software Composition Analysis (SCA) tool (e.g., Snyk, Dependabot, Socket.dev) into your CI\u002FCD pipeline to automatically flag suspicious or newly published package changes.\n- Establish a formal third-party dependency review process that evaluates maintainer reputation, package provenance, and signing status before adoption.\n- Implement a private package registry or package mirroring strategy to control which external packages are permitted within your development environment.\n\n**Detection measures:**\n- Deploy endpoint detection capable of identifying cross-platform persistence mechanisms (registry keys, cron jobs, LaunchAgents) associated with information-stealer malware.\n- Monitor outbound network traffic from developer workstations and CI\u002FCD systems for connections to unknown or suspicious cryptocurrency-related endpoints.\n- Enable npm audit logging and alert on any package installations that deviate from approved dependency manifests.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 6: Access Control Management","CIS Control 16: Application Software Security","NIST SP 800-161: Cybersecurity Supply Chain Risk Management","NIST SP 800-218 (SSDF): Secure Software Development Framework","NIST AC-2: Account Management","NIST SA-12: Supply Chain Protection","NIST SI-7: Software, Firmware, and Information Integrity","SLSA Framework: Supply-chain Levels for Software Artifacts","NIST CSF: ID.SC-4 (Supply Chain Risk Management)","GDPR Article 32: Security of processing (relevant if PII exfiltrated)","ITIL: Change Management — unauthorized change detection",{},"published","2026-06-20T16:20:40.948524+00:00","2026-06-20T16:20:40.857+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fmicrosoft-links-mastra-ai-supply-chain-attack-to-north-korean-hackers\u002F","microsoft-links-mastra-ai-supply-chain-attack-to-north-korean-hackers-2e719d","Microsoft links Mastra AI supply chain attack to North Korean hackers",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":40,"name":41,"slug":42,"description":43,"color":44},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":46,"name":47,"slug":48,"description":49,"color":50},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[52,58],{"id":53,"date":54,"edition":55,"title":56,"audio_url":57},"53f2c2fa-cfaa-41f3-a06b-6555f3f75087","2026-06-22","morning","ThreatNoir Morning Brief — June 22","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-06-22\u002Fthreatnoir-morning-brief-2026-06-22.mp3",{"id":59,"date":60,"edition":55,"title":61,"audio_url":62},"986d219a-0eb5-4010-a161-a815f20a1ca0","2026-06-21","ThreatNoir Weekend Brief — June 21","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-06-21\u002Fthreatnoir-morning-brief-2026-06-21.mp3",[64,68,72],{"slug":65,"name":66,"problem":67},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":69,"name":70,"problem":71},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",{"slug":73,"name":74,"problem":75},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]