Microsoft Attributes Mastra npm Supply-Chain Attack to North Korean Group
Summary
Microsoft attributes the compromise of more than 140 Mastra npm packages to North Korean actor Sapphire Sleet. The packages delivered a dependency that deployed a cross-platform stealer targeting credentials, API keys, and cryptocurrency wallets.
Key points
- Microsoft assesses with high confidence that Sapphire Sleet, also known as BlueNoroff, was behind the attack.
- Attackers reportedly hijacked the npm maintainer account ehindero to publish malicious updates to more than 140 packages in the @mastra scope.
- The updates added easy-day-js, a typosquatted dependency that ran a post-install hook and deployed a dropper.
- Microsoft says the second-stage stealer targeted Windows, Linux, and macOS, collecting host and browser information and seeking credentials, API keys, authentication tokens, and cryptocurrency wallets.
- The malware used operating-system-specific persistence methods, including Windows Registry Run keys, macOS LaunchAgents, and Linux systemd services.
- Microsoft reports that affected systems showed follow-on activity using tactics, tooling, and infrastructure previously associated with Sapphire Sleet.
Article Details
- Event Type
- npm software supply-chain attack involving compromised maintainer credentials and malicious package updates
- Impact
- More than 140 packages in the @mastra scope were reportedly updated to include the malicious easy-day-js dependency. On installation, it deployed a dropper and a cross-platform information stealer targeting Windows, Linux, and macOS systems. The malware targeted credentials, API keys, authentication tokens, and cryptocurrency wallets. Microsoft also reported follow-on activity on systems that communicated with attacker-controlled C2 infrastructure.
MITRE ATT&CK
T1059.001 · PowerShellMicrosoft linked follow-on activity to deployment of a PowerShell backdoor previously used by Sapphire Sleet.T1105 · Ingress Tool TransferThe dropper downloaded a second-stage payload from attacker-controlled C2 infrastructure.T1195.001 · Compromise Software Dependencies and Development ToolsAttackers compromised a package maintainer account and published malicious updates to npm packages.T1543.001 · Launch AgentThe malware used macOS LaunchAgents for persistence.T1543.002 · Systemd ServiceThe malware used Linux systemd services for persistence.T1543.003 · Windows ServiceFollow-on activity included a malicious Windows service that granted SYSTEM privileges.T1547.001 · Registry Run Keys / Startup FolderThe malware used Windows Registry Run keys for persistence.T1562.001 · Disable or Modify ToolsFollow-on activity included Microsoft Defender exclusions.
Threat Actors
BlueNoroffThe article identifies BlueNoroff as another name for Sapphire Sleet, which Microsoft attributed the npm supply-chain attack to with high confidence.Sapphire SleetMicrosoft attributed the npm supply-chain attack to Sapphire Sleet with high confidence and described the group as a North Korean state actor.
Vendors
Products
Axios#SapphireSleetdayjs#SapphireSleetMastraMicrosoft says the Mastra AI supply chain attack that hit more than 140 npm packages was carried out by Sapphire Sleet, also known as BlueNoroff, a North Korean state actor.Microsoft Defender Antimalware PlatformThis includes the deployment of a PowerShell backdoor previously used by the group, additional persistence mechanisms, Microsoft Defender exclusions, and a malicious Windows service that granted SYSTEM privileges.npmMicrosoft says the Mastra AI supply chain attack that hit more than 140 npm packages was carried out by Sapphire Sleet, also known as BlueNoroff, a North Korean state actor.