Kursol
AI Breaking News is an AI-generated alert, curated and reviewed by the Kursol team. When major AI developments happen, we break down what it means for your business.
North Korean state hackers compromised more than 140 npm packages in the Mastra AI agent framework on June 17, backdooring every install with a credential-stealing dropper before most teams noticed anything was wrong. Microsoft attributed the campaign to Sapphire Sleet, a North Korean state actor active since at least 2020. The attackers social-engineered a Mastra maintainer through a compromised LinkedIn account, took his npm publishing credentials, and pushed a poisoned fake dependency called "easy-day-js" — a clone of the popular dayjs library — into the packages. The Hacker News put the final count at 145 packages, including @mastra/core, which alone draws over 918,000 weekly downloads. Combined weekly downloads across the affected packages topped 1.1 million.
The Attack Ran Before Anyone Could Review the Code
Mastra is a framework developers use to build AI agents, putting it several layers deep in the toolchain of any company building or buying agent-based AI products. That is what made this effective: the malicious code fired from a postinstall hook the moment npm install ran, not when the application executed. Standard code review catches problems in the code your team writes. It does not catch a dependency-of-a-dependency running a payload during setup, before a line reaches a pull request.
The dropper disabled TLS certificate verification, contacted command-and-control infrastructure, and dropped a second-stage remote access trojan built to harvest browser credentials and target more than 160 cryptocurrency wallet extensions. According to StepSecurity, the mass-publishing campaign compromised the full set of packages in an automated 88-minute window — fast enough that manual monitoring had no real chance of catching it in progress.
Removing the Package Does Not Undo the Damage
The dropper ran once, at install time, and self-deletes to cover its tracks. Rolling back to a clean package version does not remove a second-stage trojan that already established persistence. Security researchers are advising any organization that installed a Mastra package on or after June 16 to treat the machine as compromised outright — full credential rotation and a persistence audit, not a dependency bump.
This is the second attack of this exact pattern in as many months. Kursol covered the first, a PyTorch Lightning compromise that stole cloud credentials from AI teams in May. Two incidents in seven weeks, both targeting AI development tooling rather than generic npm packages, is enough to call this a pattern. State-sponsored actors have identified the AI dev-tool supply chain as a productive target.
What to Do This Week
1. Audit your dependency tree for any Mastra or @mastra package installed on or after June 16, 2026. Treat a hit as a compromised machine, not a version bump. Rotate every credential it had access to — cloud keys, npm tokens, internal service credentials — and run a persistence check before returning it to service.
2. Add postinstall-script review to how you onboard any new AI development dependency. Running npm install --ignore-scripts by default, then reviewing what a package's install scripts actually do before allowing them, closes the exact door this attack walked through.
3. Put dependency risk on your AI vendor evaluation checklist, not just your engineering team's. If your business is buying or building AI agent tooling, ask vendors how they handle upstream dependency security — see our AI procurement checklist for the questions worth asking before you sign anything.
The Bottom Line
The AI dev-tool ecosystem has grown large enough to be a specific, repeatable target rather than incidental collateral in broader npm attacks. Two credential-stealing supply chain compromises against AI-specific tooling in seven weeks is a signal that any business running AI development pipelines needs dependency hygiene as a standing practice, not a one-time response to this incident.
If you're not sure whether your development stack has this kind of exposure, take our free AI readiness assessment to see where you stand.
AI Breaking News is Kursol's rapid analysis of major artificial intelligence developments—focused on what actually matters for your business. Subscribe to our RSS feed to stay informed.
FAQ
Possibly, if your AI tooling has Mastra somewhere in its dependency tree, even indirectly. Treat this as a warning about the category of risk rather than a single framework. Any AI development dependency your team pulls in can carry the same postinstall-script exposure. Audit what your build pipeline installs, not just what your team wrote.
No. The dropper executed at install time and the second-stage payload can persist independently of the package that delivered it. Removing or upgrading the package does not remove a trojan already on the machine. Treat any machine that installed an affected version as compromised, rotate its credentials, and check for persistence before trusting it again.