Mastra AI npm Supply Chain Attack (June 2026)
Last changed 2026-11-01 · Fact-check review — Fact-check review (verdict: revise): the reviewer checked the page's claims against its sources; the trust score did not change. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·2qURjX…Wz5gSummary
On June 16-17, 2026, attackers published a typosquatted npm package, easy-day-js, imitating the dayjs date library, then used the hijacked 'ehindero' account, which held never-revoked publish rights, to inject it as a dependency into 140+ packages in the @mastra npm scope within about 88 minutes. The malicious postinstall payload was a cross-platform remote access trojan and infostealer that inventoried 166 cryptocurrency wallet extensions and harvested browser data, LLM API keys, cloud and CI/CD secrets before deleting itself; affected packages had more than 1.1 million combined weekly downloads by the most-cited estimate. Mastra and npm unpublished or superseded the malicious versions within hours; attribution remains unconfirmed, though researchers note overlaps with North Korea-linked Sapphire Sleet tradecraft.
Connected Entities
6 entities · 60 linked investigations- Mastra AI npm Supply Chain Attack (June 2026)→mentioned with→Coinbase(75%)
- Phantom Wallet→mentioned with→Coinbase(60%)
- Mastra AI npm Supply Chain Attack (June 2026)→mentioned with→Binance(75%)
- Mastra AI npm Supply Chain Attack (June 2026)→mentioned with→Phantom Wallet(65%)
- Mastra AI npm Supply Chain Attack (June 2026)→mentioned with→Sapphire Sleet / UNC1069(80%)
- easy-day-js / Mastra npm Supply Chain Attack→mentioned with→Coinbase(75%)
- easy-day-js / Mastra npm Supply Chain Attack→mentioned with→Phantom Wallet(65%)
Connected Through
4 shared actors · 602 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Binanceorganization
- ♦Coinbasetoken
- □Phantom Walletorganizationalso in
- □Sapphire Sleet / UNC1069organization
1 submission awaiting moderator review.
Timeline(11 events)
2024
npm account 'ehindero' publishes legitimate alpha versions of @mastra/core (late 2024 to early 2025), acquiring scope-wide publish rights that are never revoked.
SnykMay 2026
An identical loader to the easy-day-js dropper is detected on public malware sandboxes around May 29, 2026, about 19 days before the attack.
JFrog Security ResearchJune 2026
npm account sergey2016 publishes easy-day-js@1.11.21, a clean copy of dayjs, on June 16, 2026 at 07:05 UTC.
StepSecurity / JFrogJune 2026
easy-day-js@1.11.22 is published at 01:01 UTC on June 17, 2026 with the obfuscated postinstall dropper (setup.cjs) and tagged 'latest'.
StepSecurity / Endor Labs / SocketJune 2026
Between 01:12 and 02:39 UTC on June 17, 2026, the hijacked ehindero account republishes 140+ (141-145 depending on source) @mastra packages with the easy-day-js dependency over about 88 minutes.
StepSecurity / Snyk / Socket / Endor LabsJune 2026
Endor Labs detects the first malicious republish about 2 minutes and 18 seconds after it appears on the registry (June 17, 2026).
Endor LabsJune 2026
Mastra becomes aware of the attack at about 8:45 PM PT on June 16 (June 17 UTC) and contacts npm and Socket; by 11:57 PM PT 110 packages are unpublished and 6 deprecated.
Mastra GitHub Issue #18061June 2026
Safe versions are published around 1:00 AM PT on June 17 via PR #18056, forward-rolling 142 packages, restoring @mastra/core latest to 1.42.0 and removing the MFA token bypass; npm removes easy-day-js, flags versions under SNYK-JS-EASYDAYJS-17353313 and removes ehindero as scope owner.
Snyk / Mastra GitHub Issue #18061 / The Hacker NewsJune 2026
Mastra's incident report states the compromised maintainer was an active employee phished through a fraudulent LinkedIn message; Snyk reports the ehindero account email had been changed to ehindero2016@tutamail.com.
Mastra GitHub Issue #18061 / SnykJune 2026
Microsoft's security blog publishes an analysis of the attack with threat-hunting guidance (June 17, 2026).
Microsoft Security BlogJune 2026
Security firms including StepSecurity, Socket, OX Security, JFrog, Snyk, Orca Security, Phoenix Security, SafeDep, Cloudsmith and Kodem publish technical analyses and response runbooks (dated June 17 on one page and June 18 on the other); JFrog flags all compromised versions within 24 hours.
OX Security / JFrogDecision Log
- slot 464263458 · hash A7rW71PHxrLga5tnQUrfBrXpavBPWgqSn115zK5Xz4o
- slot 464263453 · hash 9cS4vaxhNZtJ4SjnVLPWNMLALXzjkGoWifvZDz3okHrM
- slot 457588985 · hash 98AgtJJABQFcEH9ZyJBCSkbU1fVSiim2sD4cSPaBZ4aJ
- slot 443517893 · hash 6FEpP5vh3Xym71jYs44mRjq7Pdird7XVgcjRuNPRkbZ1
- slot 443517889 · hash J9yHSmEs27ubbsWJUQEddPWFsJotJGX4vQ1Ud8Kw3DJ7
- slot 427504832 · hash GDUcSUD2NG6q8Kh9tmF9bqZfSfpUfryH7K8b5Lt7U69j
This investigation is cryptographically anchored to the Solana blockchain (6 decisions). 17 of 17 cited source URLs have an Internet Archive snapshot.
model: claude-code-merge-writer
generated: 6/19/2026, 12:20:56 PM
last updated: 11/1/2026, 10:40:25 PM
6 viewsavoid.net — verified advice for a post-truth world