Mastra npm compromise planted malware in 140+ packages to steal browser data

Jun 18, 2026 · Original article ↗

Summary

A compromised Mastra npm maintainer account was used to inject a malicious dependency into more than 140 packages. The malware installs a cross-platform backdoor that steals browser data and can run attacker-supplied code; attribution remains unconfirmed.

Key points

Between about 01:12 and 02:36 UTC on June 17, 2026, an attacker republished more than 140 packages in the @mastra npm scope after taking over a dormant maintainer account.
The attacker added easy-day-js as a dependency. Its benign 1.11.21 release was followed by a malicious 1.11.22 release that the injected caret-version range could resolve during installation.
The two-stage malware disables TLS certificate validation, downloads and launches a cross-platform implant, and installs persistence on Windows, macOS, and Linux.
The implant collects host details, running processes, installed applications, browser history, and data from 166 browser extensions, including cryptocurrency wallets and password managers.
The implant communicates with command-and-control infrastructure, uses time-seeded DGA domains as fallbacks, and can execute attacker-supplied code.
The report describes tradecraft overlap with the earlier Axios npm compromise, which Microsoft attributed to Lazarus Group, but says attribution of the Mastra campaign is unconfirmed.
Recommended response includes pinning Mastra packages to known-good pre-incident versions, removing resolved easy-day-js packages, checking npm signatures, and rotating secrets on affected hosts.

Article Details

Attack Vectors: A dormant maintainer account was reportedly taken over and used to republish more than 140 packages in the @mastra npm scope.
The attacker injected the typosquatted dependency easy-day-js into package manifests. Although the manifests specified ^1.11.21, npm could resolve the weaponized 1.11.22 release.
The malicious package's postinstall hook disabled TLS certificate validation, downloaded a second-stage implant, launched it detached, and deleted the dropper.
The implant stole browser history and data from browser-extension directories, including cryptocurrency-wallet and security-extension data, and supported arbitrary remote code execution through its C2.
Defensive Notes: Pin @mastra packages to known-good pre-incident versions, remove any resolved easy-day-js package, and use npm audit signatures or an equivalent policy that requires attestations.
Hunt for Node.js code that sets NODE_TLS_REJECT_UNAUTHORIZED = '0', unexpected NodePackages or nvmconf directories, and the NvmProtocal Windows Run key.
Pre-compute and block the implant's time-seeded DGA domains; the article says the seed rotates every three days.
Rotate cryptocurrency wallet seeds or keys and browser-stored secrets on hosts where the implant ran.

Indicators of compromise

Type	Indicator	Context
HOSTNAME	`hwsrv-1327785[.]hostwindsdns[.]com`	Reverse-DNS hostname identified in the report for the malicious C2 host.
HOSTNAME	`hwsrv-1327786[.]hostwindsdns[.]com`	Reverse-DNS hostname identified in the report for the malicious delivery host.
IPV4	`23[.]254[.]164[.]123`	Primary C2 IP passed to the implant by the dropper.
IPV4	`23[.]254[.]164[.]92`	Reported stage-two payload delivery host; the dropper downloads the implant from this IP on port 8000.
SHA256	`221c45a790dec2a296af57969e1165a16f8f49733aeab64c0bbd768d9943badf`	SHA-256 hash of the stage-two implant payload.
SHA256	`4a8860240e4231c3a74c81949be655a28e096a7d72f38fbe84e5b37636b98417`	SHA-256 hash of the weaponized easy-day-js@1.11.22 tarball.
URL	`hxxps[:]//23[.]254[.]164[.]92:8000/update/49890878`	Stage-one dropper URL used to download the second-stage implant.