# Mastra AI npm scope takeover via `easy-day-js` typosquat dropper

> On 2026-06-17 between ~01:12 and 02:36 UTC, the dormant `ehindero` contributor account - never revoked from the `@mastra` scope - was used to mass-publish ~144 trojanised `@mastra/*` releases plus `mastra` and `create-mastra`, each declaring a new `easy-day-js` dependency whose `postinstall` hook drops a cross-platform crypto-wallet stealer / RAT. Microsoft attributes the activity to **Sapphire Sleet (BlueNoroff)** with high confidence; combined exposure ~1.1M weekly downloads.

- Published: 2026-06-17
- Last updated: 2026-06-21
- Severity: critical
- Kind: Compromise - A legitimate, already-used package, maintainer account, CI pipeline, or release tag was hijacked and a malicious version was published under a name people already depend on.
- Ecosystems: npm
- Scope: 17 packages, 17 compromised versions
- Tags: account-takeover, typosquat, infostealer, crypto-wallet-drain, credential-theft, obfuscation, dormant-domain
- Threat actor: Sapphire Sleet (BlueNoroff)
- Also known as: easy-day-js campaign, Mastra scope takeover
- Detected by: Socket, Microsoft, JFrog, Snyk, StepSecurity, Mend, Aikido, Phoenix Security, SafeDep, OX Security, Endor Labs
- Incident ID: npm-2026-06-17-mastra-easy-day-js

## Affected packages (17)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@mastra/agent-browser](https://dependencywatch.io/package/npm/@mastra/agent-browser) | npm | 0.3.2 |
| [@mastra/auth](https://dependencywatch.io/package/npm/@mastra/auth) | npm | 1.0.3 |
| [@mastra/core](https://dependencywatch.io/package/npm/@mastra/core) | npm | 1.42.1 |
| [@mastra/evals](https://dependencywatch.io/package/npm/@mastra/evals) | npm | 1.3.1 |
| [@mastra/github-signals](https://dependencywatch.io/package/npm/@mastra/github-signals) | npm | 0.1.2 |
| [@mastra/loggers](https://dependencywatch.io/package/npm/@mastra/loggers) | npm | 1.1.3 |
| [@mastra/mem0](https://dependencywatch.io/package/npm/@mastra/mem0) | npm | 0.1.14 |
| [@mastra/memory](https://dependencywatch.io/package/npm/@mastra/memory) | npm | 1.20.4 |
| [@mastra/node-audio](https://dependencywatch.io/package/npm/@mastra/node-audio) | npm | 0.1.8 |
| [@mastra/node-speaker](https://dependencywatch.io/package/npm/@mastra/node-speaker) | npm | 0.1.1 |
| [@mastra/rag](https://dependencywatch.io/package/npm/@mastra/rag) | npm | 2.2.2 |
| [@mastra/react](https://dependencywatch.io/package/npm/@mastra/react) | npm | 1.0.1 |
| [@mastra/schema-compat](https://dependencywatch.io/package/npm/@mastra/schema-compat) | npm | 1.2.12 |
| [@mastra/voice-playai](https://dependencywatch.io/package/npm/@mastra/voice-playai) | npm | 0.12.2 |
| [create-mastra](https://dependencywatch.io/package/npm/create-mastra) | npm | 1.13.1 |
| [easy-day-js](https://dependencywatch.io/package/npm/easy-day-js) | npm | 1.11.22 |
| [mastra](https://dependencywatch.io/package/npm/mastra) | npm | 1.13.1 |

## What happened

Between 01:12 and 02:36 UTC on 2026-06-17 (18:12–19:36 PT 2026-06-16), an attacker logged into the dormant npm account `ehindero` - a legitimate former Mastra contributor whose owner permissions on the `@mastra` scope had never been revoked - and mass-published trojanised versions of ~144 packages across the namespace. The account had been inactive for ~16 months and the publish email had been quietly switched from a gmail.com address to a tutamail.com one, consistent with a credential takeover followed by email substitution.

The code inside each `@mastra/*` tarball was byte-for-byte identical to its clean predecessor save for a single added production dependency: `easy-day-js`. That package, a `dayjs` typosquat published a day earlier (2026-06-16 07:05 UTC) by an unrelated account `sergey2016`, shipped a clean `1.11.21` release as bait, then a weaponised `1.11.22` carrying an obfuscated `postinstall` hook (`setup.cjs`). Because every affected `@mastra/*` package declared the dependency as `^1.11.21`, fresh installs resolved to the malicious `1.11.22` and ran the dropper automatically.

The loader disables TLS certificate verification, fetches a second-stage payload from `23.254.164.92:8000/update/49890878`, executes it as a detached background process pointing at C2 `23.254.164.123:443`, then deletes itself. The second stage is a cross-platform information stealer plus remote-access trojan: it harvests browser history and the stored data of >160 cryptocurrency wallet browser extensions (MetaMask, Phantom, Coinbase Wallet, Solflare, OKX, Keplr, ...), installs persistence on Windows / macOS / Linux, and exfiltrates to the operators' C2. Microsoft Threat Intelligence also documents two additional staging domains - `teams[.]onweblive[.]org` and `maskasd[.]com` - and publishes SHA-256 hashes for `setup.cjs`, `easy-day-js-1.11.21.tgz`, and `easy-day-js-1.11.22.tgz` for IOC searches.

Mastra discovered the publishes at 20:45 PT, removed `ehindero` from the scope, unpublished 110 of the 116 newly-published versions, deprecated the remaining six that npm's unpublish window blocked, and forward-rolled clean releases via PR #18056 by 23:57 PT. Combined weekly download exposure across the affected packages exceeds 1.1M; `@mastra/core` alone receives >918K weekly installs (~4M monthly).

## Attribution - Sapphire Sleet (BlueNoroff)

On 2026-06-17 Microsoft Threat Intelligence published a long-form analysis attributing the activity **with high confidence to Sapphire Sleet** (also tracked as BlueNoroff / UNC1069), a North Korea-nexus actor that primarily targets financial-sector and cryptocurrency firms. The Hostwinds-hosted C2, the clean-then-armed typosquat playbook, the TLS-off / detached-spawn / self-delete `postinstall` dropper, and the >160-wallet-extension stealer payload all match the **Axios npm compromise of 2026-03-31** that Microsoft and Google also attributed to Sapphire Sleet. This is the second wide-scope npm registry takeover Microsoft has tied to the cluster within 2026.

Independent disclosures from Socket, JFrog, Snyk, StepSecurity, Mend, Aikido, Phoenix Security, SafeDep, OX Security, Endor Labs, and Cloudsmith converge on the same package set, IOCs, and account-takeover root cause. The `easy-day-js` package itself was removed from npm shortly after Socket's automated flag, ~6 minutes after the first malicious publish.

## Impact

- Cryptocurrency wallet theft: 160+ browser-extension wallets (MetaMask, Phantom, Coinbase, Solflare, OKX, Keplr) drained on install
- Cross-platform infostealer + RAT with Windows/macOS/Linux persistence
- CI/CD runner compromise: `postinstall` runs automatically during `npm install`
- Stored secrets and tokens exfiltrated to attacker C2 (`23.254.164.123:443`)
- Loader disables TLS verification before fetching the second stage

## What to do

1. Run `npm ls easy-day-js` in every project and CI runner - any match indicates execution of the dropper
2. Treat any host that installed an affected `@mastra/*` version on or after 2026-06-17 01:12 UTC as compromised; rebuild from a known-good image
3. Pin `mastra@1.13.0`, `create-mastra@1.13.0`, `@mastra/core@1.42.0` (or the post-incident clean release pushed by Mastra in PR #18056) and reinstall after deleting `node_modules` and the lockfile entries
4. Rotate browser-extension wallet seed phrases, npm tokens, cloud credentials, and any SSH/Git keys accessible from the affected machine
5. Block egress to `23.254.164.92` and `23.254.164.123` and search proxy/IDS logs for prior contacts
6. Audit npm owner lists for every scope you control and revoke any dormant former-contributor access

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [140+ Mastra npm Packages Compromised in Coordinated Supply Chain Attack](https://socket.dev/blog/mastra-npm-packages-compromised) - Socket
- [From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet](https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/) - Microsoft
- [easy-day-js: Supply Chain Campaign Targets Mastra npm Packages](https://research.jfrog.com/post/easy-day-js/) - JFrog
- [A forgotten contributor account compromised the entire Mastra npm package scope](https://snyk.io/blog/a-forgotten-contributor-account-compromised-the-entire-mastra-npm-package-scope/) - Snyk
- [Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat](https://www.stepsecurity.io/blog/mastra-npm-packages-compromised-using-easy-day-js) - StepSecurity
- [Mastra npm Scope Takeover: 140+ Packages Compromised via easy-day-js Dropper](https://www.mend.io/blog/mastra-npm-scope-takeover-easy-day-js/) - Mend
- [144 Mastra npm Packages Compromised via Hijacked Contributor Account](https://thehackernews.com/2026/06/144-mastra-npm-packages-compromised-via.html) - The Hacker News
- [INCIDENT REPORT: 2026-06-16: Mastra hit by supply-chain attack (Issue #18061)](https://github.com/mastra-ai/mastra/issues/18061) - Mastra
- [Microsoft links Mastra AI supply-chain attack to North Korean hackers](https://www.bleepingcomputer.com/news/security/microsoft-links-mastra-ai-supply-chain-attack-to-north-korean-hackers/) - BleepingComputer
- [Inside the Mastra npm supply-chain attack](https://cloudsmith.com/blog/inside-the-mastra-npm-supply-chain-attack) - Cloudsmith
- [Mastra npm packages compromised: easy-day-js supply chain attack - IOCs and response runbook](https://www.kodemsecurity.com/resources/mastra-npm-packages-compromised-easy-day-js-supply-chain-attack-iocs-and-response-runbook) - Kodem
- [easy-day-js supply chain attack hits Mastra AI in npm](https://www.ox.security/blog/easy-day-js-supply-chain-attack-hits-mastra-ai-in-npm/) - OX Security
- [easy-day-js Mastra npm supply-chain typosquat RAT (2026)](https://phoenix.security/easy-day-js-mastra-npm-supply-chain-typosquat-rat-2026/) - Phoenix Security
- [easy-day-js targets Mastra: dependency attacks grow (Sonatype-2026-003926)](https://www.sonatype.com/blog/easy-day-js-targets-mastra-dependency-attacks-grow) - Sonatype
- [SNYK-JS-EASYDAYJS-17353313: easy-day-js malicious code](https://security.snyk.io/vuln/SNYK-JS-EASYDAYJS-17353313) - Snyk

---

Canonical page: https://dependencywatch.io/incident/npm-2026-06-17-mastra-easy-day-js
Markdown version: https://dependencywatch.io/incident/npm-2026-06-17-mastra-easy-day-js.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).