North Korean Hackers Blamed for Mastra NPM Supply Chain Attack

Microsoft has attributed last week's supply chain attack on the Mastra NPM framework to North Korean state-sponsored hackers known as Sapphire Sleet. During a 45-minute window on June 17th, attackers compromised a maintainer account and published 141 malicious packages containing a typosquat dependency that deployed cross-platform malware targeting cryptocurrency wallets and system information. The attack affected the popular AI framework that sees 8 million weekly downloads, with the malicious code executing automatically during package installation on developer workstations and CI/CD pipelines across Windows, macOS, and Linux systems.