North Korean Sapphire Sleet Hijacks Mastra npm Ecosystem to Deploy Node.js Implant and PowerShell Backdoor

Microsoft Threat Intelligence has uncovered a large-scale supply chain attack on the npm registry affecting more than 140 packages within the Mastra ecosystem, attributing the campaign with high confidence to Sapphire Sleet, a North Korean state-sponsored threat group with a documented history of targeting the financial and cryptocurrency sectors. All compromised packages have since been removed from the registry, but the attack exposes serious and ongoing vulnerabilities in developer tooling pipelines and continuous integration environments.

The intrusion began with the compromise of the "ehindero" npm maintainer account, which held publishing rights across the Mastra ecosystem. Using that access, the attackers injected a malicious dependency, easy-day-js, into multiple legitimate Mastra packages. The rogue package was crafted to impersonate the widely used dayjs library, which records over 57 million weekly downloads, giving it sufficient surface credibility to avoid immediate suspicion.

Sapphire Sleet used a staged delivery approach designed to defeat pre-publish review processes. A clean bait version of the typosquat was published first, followed by a weaponised update pushed hours later. Because the malicious code was triggered through an npm post-install hook, developers did not need to explicitly import the package into their code. Simply running an installation or update command on a Mastra package that had been compromised was sufficient to execute the dropper, a hidden script named setup.cjs.

The dropper used rotated string arrays and Base64 encoding to evade static analysis. Once active, it disabled TLS certificate verification to conceal its outbound traffic, then retrieved a secondary Node.js payload from an attacker-controlled server, using two observed command-and-control addresses: 23.254.164.92 and 23.254.164.123. It also dropped hidden tracking files into the operating system's temporary directory to mark successfully infected machines.

Persistence was established across multiple operating systems through platform-specific mechanisms. On Windows, the malware created Registry keys using legitimate-looking Node.js protocol names. On macOS, it deployed hidden LaunchAgents. On Linux, it used systemd unit files. Once embedded, the implant hunted for high-value targets, explicitly targeting 166 distinct cryptocurrency wallet browser extensions alongside browser history records and detailed system metadata.

For targets identified as high value, Sapphire Sleet deployed a secondary PowerShell backdoor that executed anti-forensic cleanup routines to wipe its own command history. It then established SYSTEM-level privileges by installing a malicious Windows service configured to run automatically at boot, giving the attackers an interactive, persistent foothold on compromised infrastructure.

Microsoft assesses with high confidence that Sapphire Sleet's primary objectives in this campaign were cryptocurrency theft and the acquisition of valuable intellectual property. The group is consistent with prior Sapphire Sleet campaigns, which have concentrated on financial platforms, cryptocurrency exchanges, and technology companies with access to proprietary code.

For development and security teams, the attack underscores several specific control failures that require attention. Account takeover of a package maintainer with broad publishing rights enabled the entire campaign. Registry-level controls on dependency injection were insufficient to detect the staged delivery pattern. Post-install hooks remain a powerful and underutilised attack vector because they execute automatically without requiring explicit developer action.

Organisations operating software development pipelines should audit all Mastra package versions installed after the initial clean release, verify npm maintainer account security across all packages they depend on or publish, and treat continuous integration environments as high-value targets subject to the same threat modelling applied to production infrastructure. The CISA software supply chain defence framework provides a structured baseline for assessing and hardening these environments. For enterprises managing crypto or fintech platforms across the GCC, Sapphire Sleet's sustained focus on financial and cryptocurrency targets means this threat group should be tracked as an active adversary, not a distant one. The IMF's recent warning on systemic cyber risk to financial systems is directly relevant context for understanding why state-sponsored actors continue to prioritise this sector.