Critical Flaw in Mastra npm Packages Exposes Users to Password Stealing Malware

Key Takeaways

• A significant supply chain attack impacted 141 npm packages within the Mastra-AI ecosystem.
• The attack leveraged a typosquatting dependency to deploy a multi-stage infostealer, compromising developer machines and build environments.
• The malware is designed to steal cryptocurrency wallet data, browser history, and sensitive credentials.
• The critically affected @mastra/core package has over 918,000 weekly downloads, indicating a broad potential impact.
• Immediate mitigation steps include checking for compromise, removing malicious packages, and rotating credentials.

Sophisticated Supply Chain Attack Targets Mastra npm Packages with Infostealer

A sophisticated supply chain attack has been uncovered, compromising over 141 packages in the Mastra-AI npm ecosystem. Research teams at Microsoft and Socket identified these malicious packages, which secretly deploy an advanced infostealer payload onto developer workstations, CI/CD runners, and various build environments.

The campaign, first detected on June 17, 2026, exploited a typosquatting dependency to deliver a multi-stage malware. This highly capable payload is designed to exfiltrate critical data, including cryptocurrency wallet information, browser histories, and sensitive credentials.

Attack Vector and Timeline

Between 01:15 and 02:36 UTC on June 17, a single npm account, identified as “ehindero,” rapidly published malicious versions of 141 @mastra/* packages. The compromised package code was byte-for-byte identical to its legitimate counterparts, with the only alteration being the injection of a single malicious dependency into each manifest:

"easy-day-js": "^1.11.21"

The dependency easy-day-js is a deliberate typosquat of the widely used dayjs library. It was published the day prior by a separate account named “sergey2016.” Initially, version 1.11.21 of easy-day-js was a clean copy of dayjs, likely intended to establish a benign history.

However, version 1.11.22 introduced a weaponized postinstall hook that executed node setup.cjs. This critical change allowed the malicious payload to run automatically during npm install, even before any developer explicitly imported or used the package.

Among the affected packages is @mastra/core, a highly popular library with over 918,000 weekly npm downloads. This extensive reach indicates a substantial potential blast radius for the campaign.

Multi-Stage Malware Deployment

The attack unfolds in two distinct stages, each designed for stealth and persistence.

Stage 1 — The Loader (setup.cjs)

The initial loader, obfuscated using obfuscator.io, performs several critical functions. It disables TLS certificate verification by setting NODE_TLS_REJECT_UNAUTHORIZED=0, then writes tracking files (~/.pkg_history and ~/.pkg_logs) to fingerprint the victim machine. Following this, it fetches a second-stage payload from 23[.]254[.]164[.]92:8000/update/49890878 and launches it as a detached, hidden background process. This process then connects to the command-and-control (C2) server at 23[.]254[.]164[.]123:443. The loader then self-deletes to remove forensic evidence.

Stage 2 — The Implant (protocal.cjs)

The second stage involves a cross-platform Node.js tasking client, approximately 41 KB in size, named protocal.cjs. This implant establishes persistent access across major operating systems. On Windows, it creates a Registry Run key (NvmProtocal); on macOS, it installs a LaunchAgent (com.nvm.protocal.plist); and on Linux, it utilizes a systemd user unit (nvmconf.service). All persistence mechanisms are cleverly disguised as legitimate Node.js tooling to evade detection within developer environments.

Once established, the implant beacons to the operator’s C2 server, awaiting arbitrary commands. Its built-in capabilities include inventorying 166 cryptocurrency wallet browser extensions, such as MetaMask, Phantom, Coinbase Wallet, Binance Wallet, and TronLink. It also exfiltrates browser history from Chrome, Edge, and Brave using Node’s built-in SQLite module and conducts host reconnaissance, detailing running processes and installed applications.

What You Should Do

• Assume Compromise: Any system that executed npm install on affected @mastra/* versions should be considered compromised.
• Check for Exposure: Immediately run npm ls easy-day-js to identify if your environment is affected.
• Remove Malicious Packages: Remove any identified affected versions of @mastra/* packages.
• Pin to Safe Version: Update your project to use [email protected] and enforce this with lockfiles.
• Remove Persistence Artifacts: Manually remove all persistence mechanisms (Windows Registry Run key NvmProtocal, macOS LaunchAgent com.nvm.protocal.plist, Linux systemd user unit nvmconf.service) from affected systems.
• Rotate Credentials: Immediately rotate all credentials that were present in the installation environment, including npm tokens, GitHub tokens, cloud provider keys, and CI/CD secrets.
• Secure Cryptocurrency Wallets: For high-value cryptocurrency holdings, transfer funds to a new wallet generated from a fresh seed phrase on a completely clean and trusted device.
• Enhance CI/CD Security: Implement npm install --ignore-scripts by default in CI pipelines, enforce strict use of lockfiles, introduce package cooldown periods for newly published versions, and monitor for outbound connections to raw IP addresses during build processes.

IoCs

Network Indicators

Code & String Indicators

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.