PERMISSION/PROTOCOL
Back to incident tracker

2026-06-16

CriticalMedia report

Sapphire Sleet (North Korean APT BlueNoroff) Hijacked Mastra npm Scope and Republished 142 Packages Injecting easy-day-js RAT Over 88 Minutes

Attacker hijacked a forgotten Mastra contributor account with npm publish access. Over 88 minutes, republished 142 packages injecting easy-day-js RAT (typosquat of dayjs). Clean in v1 to build trust, second-stage RAT in later version. 1.1M weekly downloads. Sapphire Sleet (North Korean APT BlueNoroff) attribution.

MastraCredential exposurenpm scope takeover: hijacked contributor account used to inject RAT into AI framework packagesDeveloper machines / Mastra AI framework users / 1.1M weekly downloads

What happened

Sapphire Sleet hijacked a forgotten contributor account with @mastra npm scope publish access. Over 88 minutes, 142 packages were republished with the easy-day-js RAT injected. Clean v1 built false trust before RAT payload was revealed in later versions.

Why it matters

142 Mastra AI framework packages compromised. 1.1M weekly downloads potentially exposed to easy-day-js RAT. AI developers building with Mastra received trojanized packages. RAT payload enabled persistent access to developer machines. Sapphire Sleet targeting pattern: cryptocurrency theft from developer environments.

Missing authorization check

npm scope publish access must be reviewed periodically and revoked for contributors who are no longer active. Multi-person authorization should be required for publishing new versions of high-impact packages (1M+ weekly downloads).

Would PP block it?

If the RAT's consequential actions (credential reads, network exfiltration, persistence installation) required PP receipts, the North Korean APT's toolkit would face authorization gates before accessing developer credentials or cryptocurrency wallets.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-06-16

    Sapphire Sleet begins hijacking forgotten @mastra contributor account. Republishing campaign starts: 142 packages republished over 88 minutes with easy-day-js RAT injected.

  2. 2026-06-16

    First republished versions appear clean (trust-building). Later versions contain second-stage easy-day-js RAT payload.

  3. 2026-06-17

    Campaign detected. Compromised packages taken down from npm. Sapphire Sleet (BlueNoroff) attribution confirmed by threat intelligence vendors.

Technical breakdown

  • Sapphire Sleet identified a forgotten Mastra contributor account with active npm @mastra scope publish access.
  • Over 88 minutes: 142 packages republished systematically with easy-day-js RAT injected as a dependency typosquat of the popular dayjs library.
  • First version clean: building trust and bypassing security tooling that checks for new malicious packages.
  • Second-stage delivery: RAT payload in later version activates after the trusted first version has been downloaded and the pattern established.
  • Easy-day-js RAT: persistent access tool targeting developer credential stores and cryptocurrency wallet data — consistent with Sapphire Sleet's financial theft mission.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Credential exposure. The relevant Permission Protocol gate is Deploy Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
Consequential action gate on developer machines, credential access authorization
Still needs
Periodic contributor access review; multi-person authorization for high-impact package publishes; abandoned account cleanup
Receipt required for
Installing new packages from npm, any consequential action by newly installed packages

PP's Deploy Gate would require receipts for consequential actions the RAT attempts on developer machines. It would not prevent installation of the compromised packages — that requires supply chain controls (contributor access reviews, package signing).

Start small

Put the relevant gate at this action boundary.

This incident maps to Deploy Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Install on one repo