Sapphire Sleet Compromises 145 Mastra AI Packages: Anatomy of an npm Supply Chain Attack and Microsoft's Response

On June 17, 2026, the North Korean state-sponsored hacking group Sapphire Sleet (also tracked as BlueNoroff and APT38) executed one of the fastest and most consequential software supply chain attacks ever documented. In roughly 88 minutes, the group compromised 145 packages in the @mastra/* namespace on npm — a popular TypeScript framework for building AI-powered applications and agents .

The affected packages had a combined weekly download count exceeding 1.1 million . The attack sent shockwaves through the AI developer ecosystem and prompted immediate policy changes from Microsoft, which attributed the operation to Sapphire Sleet with high confidence on June 19, 2026 .

How the Compromise Worked

The attack chain followed a pattern that security researchers have been warning about for years — and exploited exactly the kind of credential weakness that package registries are now racing to eliminate.

Step 1: Social Engineering and Account Hijack

The attackers first targeted a legitimate Mastra maintainer through social engineering, successfully compromising their npm account credentials . The compromised account, identified as "ehindero," had publishing privileges across the entire @mastra scope .

Step 2: Rapid Mass Publication

Using the hijacked account, the attackers republished all packages under the @mastra/* namespace within an 88-minute window. Some reports describe the bulk publication burst as occurring in as few as 19 minutes . This speed suggests an automated publishing script rather than manual uploads.

Step 3: Malicious Dependency Injection

Each compromised package version was seeded with a malicious dependency named "easy-day-js" — a typosquat of the legitimate and widely used "dayjs" date library . Security researchers have named this campaign "easy-day-js" .

Step 4: Automatic Payload Execution

The malicious code was designed to execute automatically via npm's postinstall script. Any developer who ran

npm install

Step 5: Credential and Crypto Theft

Once executed, the payload harvested cryptocurrency wallet keys, cloud credentials, and CI/CD secrets from the affected developer's workstation and build systems . The payload also disabled TLS verification and downloaded a second-stage stealer from attacker-controlled infrastructure .

Attribution

On June 19, 2026, Microsoft assessed with high confidence that the attack was the work of Sapphire Sleet, a North Korean state actor that primarily targets the financial and cryptocurrency sectors. Microsoft cited infrastructure and tactics, techniques, and procedures (TTPs) consistent with previously documented Sapphire Sleet operations . Amazon Threat Intelligence has also linked Sapphire Sleet to earlier campaigns against NPM packages including axios, debug, chalk, and typo-crypto .

Microsoft's Security Response

The Mastra attack accelerated several security changes that Microsoft had already been developing. The company announced two major policy shifts aimed at eliminating the exact credential vector that Sapphire Sleet exploited.

1. NuGet API Key Lifetime Reduction to 30 Days

Effective August 17, 2026, Microsoft is reducing the maximum lifetime of newly created NuGet.org API keys from 365 days to 30 days . All API keys created before that date will be forcibly expired on November 1, 2026 .

The rationale is clear: long-lived API keys are "loose strings that are easy to lose" and have become a primary attack vector for supply chain compromise . A stolen key gives an attacker an extended window to publish trojanized packages — exactly what happened in the Mastra incident and the recent NX Console npm compromise .

2. Trusted Publishing (OIDC-Based) as the Recommended Default

Microsoft is strongly recommending that all package maintainers migrate to Trusted Publishing — a modern workflow launched in September 2025 that replaces long-lived API keys with short-lived OpenID Connect (OIDC) authentication .

Key advantages of Trusted Publishing :

• No long-lived secrets stored in repository or CI/CD systems
• Short-lived credentials issued per-publish that expire automatically (typically about 1 hour)
• Workload identity validation against the repository, workflow, and optional environment configured in the policy
• No manual secret rotation required
• Drastically reduced blast radius if credentials are ever disclosed

When a CI/CD workflow using Trusted Publishing runs, it requests a cryptographically signed OIDC token from the provider (e.g., GitHub Actions). NuGet.org validates that token against the registered publisher policy and issues a temporary, single-use API key valid only for that publishing session .

3. Broader Ecosystem Measures

Several complementary changes across the npm and package management ecosystem reinforce Microsoft's response:

• npm classic tokens revoked: npm permanently revoked all classic long-lived tokens in December 2025. The

  npm login

  command now issues only two-hour session tokens .

• npm granular token expiration: New write-enabled granular access tokens now have a 7-day default and 90-day maximum expiration, reduced from unlimited and 30-day defaults .

• npm staged publishing: Generally available as of May 2026, this feature requires maintainers to pass a 2FA challenge to explicitly approve a release before it becomes publicly installable .

These measures collectively aim to eliminate exactly what Sapphire Sleet exploited: a single long-lived, weakly guarded npm maintainer token with publishing access to an entire package scope.

Key Takeaways for Developers and Maintainers

• Rotate your existing NuGet API keys now: If you have keys created before August 17, 2026, they will expire on November 1, 2026. Generate new keys or migrate to Trusted Publishing before that date .

• Adopt Trusted Publishing as soon as possible: OIDC-based authentication eliminates the need to store long-lived secrets in your CI/CD pipelines. It is supported by NuGet.org, npm, and PyPI .

• Review your npm publishing workflows: npm now uses short-lived session tokens, granular tokens with limited lifetimes, and staged publishing. Ensure your CI/CD pipelines are updated to use one of these supported authentication methods .

• Pin package versions and avoid automatic dependency upgrades: Especially for critical infrastructure, pinning known-good versions can prevent accidental inclusion of compromised packages .

• Disable automatic script execution when installing packages: Running

  npm install --ignore-scripts

  (or setting

  ignore-scripts = true

  globally) can prevent malicious postinstall scripts from executing .