Fact-check findings
What an automated fact-checker found when it re-read Mastra AI npm Supply Chain Attack (June 2026) against the sources the page cites. Only the most recent review is shown.
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
2 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #2[disputed][awaiting moderator]in section: Cryptocurrency Wallet Targeting
“No government agency, law enforcement body or threat-intelligence firm has formally attributed this incident.”
reviewerNo threat-intelligence firm has formally attributed the incidentDirectly contradicted by Microsoft, a threat-intelligence firm, whose blog is cited in this very section.Proposed correction (not yet applied)No government agency or law enforcement body has formally attributed this incident; Microsoft Threat Intelligence assessed with high confidence on June 19, 2026 that it is attributable to Sapphire Sleet. - #3[disputed][awaiting moderator]in section: Malicious Package: easy-day-js Typosquat
“Twenty-six minutes after 1.11.22 was published, the ehindero account began mass-publishing the trojanised Mastra packages.”
reviewerMass publishing began 26 minutes after easy-day-js 1.11.22 was publishedThe page's own timeline gives 01:01 and 01:12 UTC, which is 11 minutes, not 26.Proposed correction (not yet applied)Eleven minutes after 1.11.22 was published, the ehindero account began mass-publishing the trojanised Mastra packages.
unverifiable
1 claimNo source the reviewer could reach confirms or contradicts the claim.
- #7[unverifiable][awaiting moderator]in section: Attribution
“restoring @mastra/core latest to 1.42.0”
reviewer@mastra/core latest restored to 1.42.0Not confirmed in the issue text I could read.
stale
1 claimThe claim was accurate when written but events since have overtaken it.
- #1[stale][awaiting moderator]in the summary
“attribution remains unconfirmed, though researchers note overlaps with North Korea-linked Sapphire Sleet tradecraft”
reviewerAttribution to Sapphire Sleet remains unconfirmed, with only tradecraft overlaps notedThe page cites the Microsoft blog yet describes only 'overlaps'. Microsoft made a formal high-confidence attribution; Snyk's caution predates or disagrees with it.Proposed correction (not yet applied)Microsoft assessed with high confidence (June 19, 2026 update) that the activity is attributable to Sapphire Sleet, a North Korean state actor, although other researchers such as Snyk and SafeDep say attribution is not independently confirmed
partially supported
2 claimsThe cited evidence supports part of the claim but not all of it.
- #4[partially supported][awaiting moderator]in the summary
“affected packages had more than 1.1 million combined weekly downloads by the most-cited estimate”
reviewerCombined weekly downloads exceeded 1.1 millionFigure is stated by the source but is internally inconsistent; the page already notes that sources differ (OX reports about 8M). - #10[partially supported][awaiting moderator]in section: Response and Remediation
“macOS ~/Library/LaunchAgents/com.nvm.protocal.plist; Linux ~/.config/systemd/user/nvmconf.service”
reviewerPersistence paths (macOS LaunchAgent location, Linux systemd unit location) in the IOC listArtifact names are correct but the directory paths differ from Microsoft's report. Other sources may give the paths the page uses; none of the cited sources could be checked for them. Windows Run key NvmProtocal confirmed.
confirmed
4 claimsThe cited evidence supports the claim as written.
- #5[confirmed][no action needed]in section: Attack Overview
“to run an automated campaign between 01:12 and 02:39 UTC on June 17 (about 88 minutes)”
reviewerRepublish window 01:12-02:39 UTC, about 88 minutes; easy-day-js 1.11.21 at 07:05 UTC June 16 and 1.11.22 at 01:01 UTC June 17Matches StepSecurity and Microsoft publish times for easy-day-js. - #6[confirmed][no action needed]in section: Attribution
“By 11:57 PM PT, 110 compromised packages had been unpublished and 6 deprecated, since npm prevented those 6 from being fully unpublished.”
reviewerMastra unpublished 110 packages and deprecated 6; safe versions via PR #18056 around 1 AM PTMatches the official issue. The issue was closed as completed on Jul 28. - #8[confirmed][no action needed]in section: Initial Access: Compromised Account and Stale Permissions
“states that the compromised maintainer was an active Mastra employee whose account was compromised through social phishing”
reviewerCompromised maintainer was an active employee phished via LinkedIn, per MastraPage correctly flags the conflict between accounts. - #9[confirmed][no action needed]in section: Initial Access: Compromised Account and Stale Permissions
“According to Snyk, the attacker changed the account's email to 'ehindero2016@tutamail.com'”
reviewerSnyk: ehindero dormant about 16 months and email changed to ehindero2016@tutamail.comConsistent with Snyk.