How North Korea Poisoned 131 Mastra npm Packages to Hit AI Developers

Why would a nation-state bother hijacking an AI framework's npm account instead of just phishing a bank? Because in 2026, the laptop of an AI developer is the bank — it's sitting on LLM provider keys, cloud tokens, database credentials, and crypto wallets all at once. STARDUST CHOLLIMA, the DPRK-linked cluster CrowdStrike has been tracking for years, proved exactly that point on June 17, 2026, in an 88-minute publishing spree that most of the industry didn't hear about until CrowdStrike's 2026 Threat Hunting Report dropped in August.

I've spent enough years around identity and access management to know that the scariest breaches are rarely the ones with a flashy zero-day. This one didn't need one. It needed a single compromised npm token, a fake date library, and a postinstall hook. That's it. No second-stage exploit, no privilege escalation chain — just npm install doing exactly what it's designed to do.

What actually happened

Mastra is an open-source TypeScript/JavaScript framework for building AI agents — the kind of tooling that sits between a developer's code and whichever LLM provider they're calling. It's popular enough that @mastra/core alone pulls more than 918,000 downloads a week on npm. That popularity is exactly what made it a target.

On June 16, 2026, an npm account calling itself sergey2016 published a package called easy-day-js — a functional, clean clone of the widely used dayjs date library. Nothing suspicious about it at that point. It worked, it did what a date library does, and it sat there for less than a day.

At 01:01 UTC on June 17, 2026, that same package was updated with the malicious payload. Then, using a hijacked npm account called ehindero — belonging to a legitimate former Mastra contributor whose scope access had never been revoked — the attacker mass-published new versions of more than 140 packages across the entire @mastra/* namespace, each one modified to pull in easy-day-js as a dependency. CrowdStrike's report counts at least 131 packages in scope; independent researchers at Socket, JFrog, and SafeDep who dissected the campaign in real time put the number at up to 145. Either way, it was an entire framework's dependency tree, poisoned in a single automated run lasting roughly 88 minutes.

The kill chain, step by step

1. Initial access via social engineering. According to Mastra's own incident disclosure, the compromised maintainer is a current, active employee whose machine was compromised after a fake LinkedIn recruiter profile reached out, moved the conversation to a video call, and got him to click a malicious link during that call.
2. Credential/token abuse. Mastra required MFA for npm publishing, but — critically — still allowed a legacy token-bypass path for CI convenience. That bypass is what let the attacker publish without triggering a second factor.
3. Decoy dependency published clean. easy-day-js went live as a working, harmless dayjs clone on June 16, 2026 at 07:05 UTC, under a separate throwaway account (sergey2016) with no obvious connection to Mastra.
4. Weaponization. The package was updated with an obfuscated malicious payload at 01:01 UTC on June 17, 2026.
5. Mass distribution. Using the hijacked ehindero account, the attacker published new “latest”-tagged versions of 140+ Mastra packages, each with easy-day-js added to package.json, over an ~88-minute window.
6. Install-time execution. Any developer, CI runner, or build pipeline that ran npm install during the exposure window triggered a postinstall script in easy-day-js — no import, no usage, no code review checkpoint required.
7. Defense evasion. The postinstall dropper disabled TLS certificate validation and fetched a second-stage payload from an attacker-controlled IP, then executed it as a detached background process and deleted itself to minimize forensic trace.
8. Payload: cross-platform infostealer. The second stage harvested browser history and credential stores, targeted more than 160 cryptocurrency wallet browser extensions, installed persistence across Windows, macOS, and Linux, and exfiltrated everything to a separate command-and-control server. It also retained the ability to poll the C2 for further modules and execute them on demand.

Key indicators

Attribution: same playbook, same actor family

CrowdStrike tracks this cluster as STARDUST CHOLLIMA, a DPRK-nexus adversary whose operational tempo has been climbing sharply since late 2025. The attribution isn't a guess pulled from thin air — the Mastra campaign is nearly a carbon copy of an earlier attack on the axios HTTP client package on March 31, 2026, where the same actor used stolen maintainer credentials to push versions bundling an updated ZshBucket malware family, again through a fake dependency (that time impersonating crypto-js instead of dayjs).

Socket's threat intelligence lead described the fingerprint plainly: a legitimate maintainer compromised, publish rights abused, the actual target packages left clean, and a malicious transitive dependency doing the dirty work at install time. That's a materially different pattern from the “Contagious Interview” playbook DPRK actors are more commonly associated with — fake recruiters sending trojanized coding assignments directly to job seekers. This is supply-chain-first, not candidate-first. Microsoft, in a follow-up update on June 19, 2026, attributed the specific campaign to Sapphire Sleet, a DPRK group it has long tracked for financial-sector targeting and, notably, the same axios compromise.

Multiple names, same actor family, same motive: currency generation. STARDUST CHOLLIMA's operations have consistently prioritized cryptocurrency theft over espionage, which is exactly why the payload went hunting through 160+ wallet extensions instead of, say, exfiltrating source code.

Why AI tooling specifically

This is the part that should worry anyone building AI products right now. Mastra sits at the exact intersection that makes a workstation compromise maximally valuable: it's installed in environments that also hold LLM API keys (OpenAI, Anthropic, and others), cloud provider credentials, vector database connection strings, and — increasingly — crypto-adjacent tooling as agentic apps start touching wallets and payment rails directly. Compromise one developer's machine during npm install and you potentially walk away with the keys to an entire AI application's backend, not just a browser's saved passwords.

CrowdStrike's broader report backs this up with numbers that should concern any CISO managing an npm-heavy stack: 87% of identified software registry threats in the first half of 2026 involved npm packages specifically, and a separate eCrime actor, ALTERED SPIDER, compromised more than 300 software dependencies in a single day during the same period. npm isn't just a convenient distribution channel anymore — it's become the preferred initial-access vector for both nation-state and financially motivated actors, and AI frameworks are now squarely in the crosshairs because of what they touch.

My Take

I've reviewed enough incident postmortems over the years to recognize a pattern when I see one: this breach didn't happen because Mastra's engineers were careless. It happened because of a single, deliberate exception carved into an otherwise reasonable control. They required MFA for publishing — that's the right call — but they also kept a legacy token-bypass path alive for CI convenience, and that's the exact seam the attacker found. I've seen this exact failure mode in enterprise IAM reviews more times than I can count: a security control that's 95% enforced is functionally a control that doesn't exist, because attackers don't attack the 95%, they go straight for the exception.

What strikes me more, though, is the initial access vector. A fake LinkedIn recruiter, a video call, a link clicked mid-conversation. That's not a sophisticated zero-day chain — it's a well-executed social engineering play against a real human under zero suspicion, because why would a “recruiter conversation” be the attack surface for a supply chain compromise? DPRK operators have been running this exact recruiting-lure playbook against developers for years (it's how a huge share of their “IT worker” and Contagious Interview operations start), and it keeps working precisely because it doesn't look like a security event until the npm publish logs already show damage.

The provenance gap is the technical detail that should get more attention than it has. Mastra's real CI releases carry SLSA provenance attestations — which is good practice — but publishing wasn't restricted to provenance-attested builds. A standard personal token could still push a release with no attestation at all, and nothing in the pipeline rejected it. That's not a Mastra-specific mistake; it's the default posture of most of the npm ecosystem today. Provenance that's optional is provenance that protects you against nothing when someone with a stolen token decides to skip it.

What You Should Do Right Now

• Check your lockfiles for exposure. Search package-lock.json, yarn.lock, or pnpm-lock.yaml across every repo and CI cache for easy-day-js or any @mastra/* package version published between June 16–17, 2026. If you find it, treat that machine or build agent as compromised — don't just uninstall and move on.
• Rotate everything that lived in that environment. LLM provider API keys, cloud IAM credentials, database connection strings, and any secrets in .env files or CI variable stores on an exposed machine. Assume the credential set is burned, not just “possibly viewed.”
• Enforce npm audit signatures or an equivalent provenance-verification gate in CI for any dependency you pull in production or developer environments. If a package publishes with SLSA provenance normally, treat an unsigned release as an automatic reject, not a warning.
• Kill token-based publish bypasses wherever MFA is supposed to be mandatory. If your org (or a package you depend on) has a “just in case” bypass for CI convenience, that's the exact seam this attack walked through. Close it or isolate it behind short-lived, scoped credentials instead of long-lived personal tokens.
• Pin dependency versions and review the scripts field in every package.json you pull in, especially for anything with a postinstall hook. That single field is where this entire campaign lived.
• Sandbox first-time installs. For any dependency you haven't vetted before, run the install in an isolated container or VM with no outbound access to sensitive infrastructure before promoting it to a real development machine.
• Train your team on the recruiter-lure pattern specifically. A LinkedIn contact moving quickly to a video call, with a link shared mid-conversation, is a known DPRK initial-access technique at this point. It deserves the same suspicion as a phishing email, not less.

This article was researched and drafted with AI assistance as part of an experiment in building a faster tech-writing workflow, then reviewed and edited before publishing.

Primary source: DPRK STARDUST CHOLLIMA poisons Mastra AI npm packages: supply chain attack on AI developers — Infosec.ge, August 11, 2026

Secondary sources: CrowdStrike 2026 Threat Hunting Report, 145 Mastra npm Packages Compromised via Hijacked Contributor Account — The Hacker News, STARDUST CHOLLIMA Likely Compromises Axios npm Package — CrowdStrike