Sapphire Sleet Hijacks Mastra Maintainer to Inject easy-day-js Dropper Across 141 Packages

Microsoft traced the attack to Sapphire Sleet, noting the attackers first staged a clean easy-day-js under sergey2016, then used the hijacked maintainer to force latest-version resolution and republish the malicious variant. The dropper writes a hidden second-stage binary to temp, executes it detached, and self-deletes. Technical artifacts include the obfuscated postinstall script and C2 domains, but no code signing or infrastructure overlap with prior BlueNoroff operations is publicly detailed.

The incident fits a documented pattern: BlueNoroff previously compromised the Axios NPM account in April with a phantom dependency RAT. Both cases relied on single maintainer credential theft rather than upstream repository compromise, exposing the trust concentration in AI-adjacent and crypto-adjacent packages that see millions of weekly downloads. Routine breach reporting rarely connects these to the broader erosion of the open-source supply chain where state actors treat maintainer accounts as persistent access vectors.

Independent confirmation of the North Korean attribution remains limited to Microsoft’s cluster analysis; Google separately labeled the Axios incident UNC1069 without linking the two. Procurement and job-posting patterns from North Korean IT fronts continue to show recruitment focused on JavaScript tooling and CI/CD abuse, indicating sustained operational priority.

Next, watch for similar account takeovers in other TypeScript AI frameworks and any reuse of the easy-day-js infrastructure. Affected organizations must rotate all tokens pulled during the window and monitor for follow-on credential harvesting.