Microsoft Attributes Mastra npm Supply-Chain Attack to Sapphire Sleet
Summary
Microsoft attributes an attack on 141 Mastra npm packages to North Korean group Sapphire Sleet. A compromised maintainer account added a malicious dependency whose installer could download and run malware; affected users are advised to check systems and rotate secrets.
Key points
- On June 17, attackers published 141 Mastra packages containing the malicious dependency easy-day-js during a 45-minute window.
- The attackers compromised the ehindero npm maintainer account and used its publishing rights to add the dependency across Mastra packages.
- An obfuscated postinstall dropper could fetch and execute a second-stage payload during npm install or npm update.
- The malware targeted Windows, macOS, and Linux, collected system information, and targeted more than 160 cryptocurrency-related browser extensions.
- Microsoft attributed the attack to North Korean group Sapphire Sleet, also known as BlueNoroff.
- Users who installed affected package versions are advised to remove them, check for malware, rotate credentials and secrets, and secure crypto wallets.
Article Details
- Event Type
- NPM supply-chain attack involving a compromised maintainer account and malicious packages
- Impact
- Attackers published 141 modified Mastra packages containing the malicious easy-day-js dependency. Systems that installed an affected package during the attack window were potentially exposed to a payload targeting Windows, macOS, and Linux, collecting system information, and targeting more than 160 cryptocurrency-related browser extensions. The packages had approximately 8 million weekly downloads.
MITRE ATT&CK
Threat Actors
BlueNoroffThe article identifies BlueNoroff as another name for Sapphire Sleet, which Microsoft attributed the Mastra supply-chain attack to.CageyChameleonThe article identifies CageyChameleon as another name for Sapphire Sleet, which Microsoft attributed the Mastra supply-chain attack to.COPERNICIUMThe article identifies Copernicium as another name for Sapphire Sleet, which Microsoft attributed the Mastra supply-chain attack to.Sapphire SleetMicrosoft attributed the Mastra supply-chain attack to Sapphire Sleet and reports that the group is also known as BlueNoroff, CageyChameleon, Copernicium, and Stardust Chollima.STARDUST CHOLLIMAThe article identifies Stardust Chollima as another name for Sapphire Sleet, which Microsoft attributed the Mastra supply-chain attack to.
Products
MastraThe North Korean state-sponsored threat actor Sapphire Sleet is behind the Mastra supply chain attack that hit over 140 NPM packages last week, Microsoft reports.npmThe North Korean state-sponsored threat actor Sapphire Sleet is behind the Mastra supply chain attack that hit over 140 NPM packages last week, Microsoft reports.