OpenSourceMalware Show #9: Mastra Supply-Chain Attack, Agentjacking and Malware Myths
Summary
The episode discusses the Mastra npm organization compromise, a paper on prompt injection targeting AI coding agents, and misconceptions about open-source malware lifespans, npm install scripts, package safeguards, and attribution.
Key points
- The hosts say attackers hijacked the Mastra npm organization’s 116 packages after a maintainer was targeted with a ClickFix-style social-engineering attack that stole credentials.
- Rather than placing malware directly in Mastra packages, attackers reportedly added the typosquatted easy-day-js package as a dependency across the organization.
- The malware reportedly targets browser extensions, including crypto wallets, password managers and browser-based MFA tools; Zapier was also among the targets. The hosts say the compromise was detected quickly.
- A Cloud Security Alliance paper describes “agentjacking”: malicious content in Sentry error events is retrieved through MCP and passed to AI coding agents, potentially causing them to act with developers’ elevated permissions.
- The hosts characterize agentjacking as prompt injection involving untrusted data and argue that agent hardening, least privilege and sandboxing matter; they note that EDR may not detect activity resembling normal development traffic.
- The hosts dispute claims that open-source malware typically lasts only a few days, that npm install scripts are going away, or that package firewalls and cooldowns eliminate nearly all risk.
- They argue that identifying an attacker can help incident responders anticipate persistence methods and choose investigation steps; they note that attribution for the Mastra compromise was not confirmed.
Article Details
- Topic
- Open-source software supply-chain malware, the Mastra package compromise, and prompt-injection risks in AI coding agents
MITRE ATT&CK
Threat Actors
Products
1Passwordnotable way: it targets browser extensions, including password managers (LastPass, Bitwarden, Dashlane, 1Password) and MFA tools, with Zapier among the more unusual targets.BitwardenAxios attack in one notable way: it targets browser extensions, including password managers (LastPass, Bitwarden, Dashlane, 1Password) and MFA tools, with Zapier among the more unusual targets.Claude[00:16:44] Jenn Gile: Um, you know, "I need to research this. I'll just ingest the logs into Claude and figure out how to fix this." Well, the logs come in through an mCP server, which that in itself I think is, like,Dashlanein one notable way: it targets browser extensions, including password managers (LastPass, Bitwarden, Dashlane, 1Password) and MFA tools, with Zapier among the more unusual targets.LastPasssimilar Axios attack in one notable way: it targets browser extensions, including password managers (LastPass, Bitwarden, Dashlane, 1Password) and MFA tools, with Zapier among the more unusual targets.MastraMastra Package Compromise: Threat actors hijacked the entire Mastra npm organization (116 packages) after a maintainer was targeted with a ClickFix-style attack that stole his credentials. Rather than injecting malwarenpmMastra Package Compromise: Threat actors hijacked the entire Mastra npm organization (116 packages) after a maintainer was targeted with a ClickFix-style attack that stole his credentials. Rather than injecting malwareSentrypaper describes a concept called "agentjacking", where attackers inject malicious instructions into Sentry error events, which AI coding agents then retrieve via MCP and execute with the developer's own elevatedZapierextensions, including password managers (LastPass, Bitwarden, Dashlane, 1Password) and MFA tools, with Zapier among the more unusual targets.