Malicious Dependency Compromises 141 Mastra npm Packages in Supply-Chain Campaign

Jun 17, 2026 · Original article ↗

Summary

A malicious dependency added to 141 Mastra npm packages ran an install-time loader that deployed a cross-platform implant. Socket says the payload collected browser history and wallet-extension inventories, installed persistence, and enabled further remote tasking.

Key points

A single npm account published 141 malicious @mastra/* package versions on June 17, 2026; the packages added the typosquatted dependency easy-day-js.
The dependency's postinstall hook ran during npm install, before the Mastra package was imported or used, and downloaded a second-stage payload.
The cross-platform implant installs login persistence on Windows, macOS, and Linux and can receive and execute follow-on code from its operators.
The recovered sample collected browser history and inventoried installed cryptocurrency wallet extensions; Socket says it did not copy wallet-extension data or read saved passwords and cookies.
Treat machines and CI runners that installed affected versions as potentially compromised; the article recommends containment, persistence removal, clean rebuilds, and rotating exposed credentials.
Socket says it detected easy-day-js within six minutes and automatically flagged and blocked affected installs for its customers.

Article Details

Attack Vectors: A human npm account mass-published compromised Mastra releases containing an added easy-day-js dependency; the original package code remained unchanged.
A clean initial release established benign package history before a subsequent release introduced a malicious postinstall hook. Transitive dependency installation triggered execution before application imports.
The obfuscated loader disabled TLS certificate validation, downloaded a second-stage payload, launched it as a detached background process, and deleted itself.
The second-stage implant established login persistence and polled its operators for arbitrary follow-on code through Node and Shell runners.
The recovered second stage collected browser history, cryptocurrency wallet-extension inventory, and host reconnaissance data for exfiltration. Although the introduction describes wallet stored-data theft, the detailed analysis explicitly states that this sample did not read wallet LevelDB contents, saved passwords, or cookies.
Defensive Notes: Treat developer workstations, CI runners, and build environments that installed affected versions as potentially compromised, even if applications never imported the packages.
Search repositories, lockfiles, package-manager metadata, CI logs, build artifacts, SBOMs, and package caches for affected versions and the injected dependency. Use npm ls easy-day-js as an initial check.
Isolate affected workstations and preserve logs before remediation. Suspend affected CI workflows and review releases, container images, packages, and deployment artifacts produced after installation.
Remove affected versions and dependency-lock entries, delete node_modules, clear package caches, and rebuild in clean environments. Verify metadata and provenance before selecting a known-clean prior release.
Package removal alone is insufficient. Remove the Windows Run-key value, macOS LaunchAgent, or Linux systemd user unit, along with dropped payloads, configuration files, temporary loader artifacts, and browser-history copies.
Hunt for detached node processes running the dropped payload and unexpected outbound connections during dependency installation.
Precautionarily rotate npm tokens, GitHub tokens, cloud credentials, CI/CD secrets, and SSH/Git credentials exposed to the installation context. The recovered sample did not read saved passwords or cookies, but follow-on tasking could deliver additional collection code.
For high-value wallets present on affected machines, the source recommends moving funds to a new wallet generated from a fresh seed phrase on a clean device; password rotation alone is insufficient.
Disable lifecycle scripts by default with npm install --ignore-scripts and selectively allow necessary scripts. Apply dependency allowlisting, package cooldown periods, lockfile enforcement, SBOM generation, and network egress controls.
Do not rely solely on provenance or trusted publishing: the malicious releases used an account with legitimate publishing rights. Socket reports that its customers' affected installations were flagged and blocked before the malicious hook executed.

Indicators of compromise

Type	Indicator	Context
HOSTNAME	`hwsrv-1327785[.]hostwindsdns[.]com`	Threat-infrastructure hostname explicitly listed among the attack's network indicators.
HOSTNAME	`hwsrv-1327786[.]hostwindsdns[.]com`	Threat-infrastructure hostname explicitly listed among the attack's network indicators.
IPV4	`23[.]254[.]164[.]123`	Operator command-and-control and exfiltration address listed in the network indicators.
IPV4	`23[.]254[.]164[.]92`	Stage-two delivery infrastructure listed in the network indicators.
SHA256	`221c45a790dec2a296af57969e1165a16f8f49733aeab64c0bbd768d9943badf`	Hash of the recovered stage-two stealer.
SHA256	`9570f77a5e1511869f4e554e7166df9fde081f2583e293c2569621792ed7d9c9`	Hash of a loader variant listed by the source.
SHA256	`b122a9873bedf145ae2a7fd024b5f309007dbb025149f4dc4ac3f7e4f32a36a4`	Hash of easy-day-js setup.cjs, the stage-one loader.
SHA256	`c38954e85bf5433e61e7c8f4230336695624ae88b6953afabf7bf817aa91b638`	Hash of the malicious easy-day-js@1.11.22 package.json.
SHA256	`cdec8b20338beb708b5be8d3d7a3041a35a8b0fb92f9186262f312d55ff82066`	Hash of a loader variant listed by the source.
URL	`hxxps[:]//23[.]254[.]164[.]123/49890878`	Second-stage command-and-control and exfiltration endpoint listed in the network indicators.
URL	`hxxps[:]//23[.]254[.]164[.]92:8000/update/49890878`	Stage-two payload download URL listed in the network indicators.