Skip to content

Back to the catalog

Mastra Attack Targets Crypto, Password Managers, Authenticators, and Zapier
opensourcemalware.comwriteup

Mastra Attack Targets Crypto, Password Managers, Authenticators, and Zapier

A threat actor took over a dormant maintainer account and republished 140+ packages in the @mastra npm scope (including @mastra/core, ~918K weekly downloads), injecting a typosquat of dayjs called easy-day-js as a new dependency in every manifest. A clean 1.11.21 version was published first, then a weaponized 1.11.22 tagged latest was pulled in via caret-range resolution, delivering a two-stage cross-platform backdoor that disables TLS validation, self-deletes, installs OS-specific persistence disguised as Node/NVM tooling, and steals browser history plus data from 166 crypto-wallet, password-manager (1Password, Bitwarden, LastPass, Dashlane, NordPass, Proton Pass, KeePassXC, Zoho Vault, Kaspersky), MFA-authenticator, and Zapier browser extensions. The report ties the campaign's Hostwinds infrastructure, clean-then-armed typosquat, and TLS-off/detached/self-delete dropper pattern to the same playbook Microsoft attributed to Lazarus Group in the earlier axios npm compromise, and compares its extension targeting to the "HyperHives" ClickFix campaign, noting npm's lack of provenance enforcement (provenance: no on the malicious wave) as the control gap that let it through.

TL;DR Compromised dormant @mastra npm maintainer account pushed 140+ packages with a typosquatted dayjs dependency (easy-day-js) delivering a cross-platform backdoor that steals crypto wallets, password managers, MFA authenticators, and Zapier extension data — tradecraft matching the Lazarus-attributed axios npm attack.
Open original ↗
Document

What it is

A June 17, 2026 npm scope takeover of @mastra (140+ packages, incl. @mastra/core at ~918K weekly downloads). SafeDep attributes the malicious publishes to the ehindero account — a former contributor that published clean alpha versions Nov 2024–Feb 2025, then went dormant. The malicious wave originated from a changed account email, the classic account-takeover fingerprint. The injected dependency is the typosquat easy-day-js (a dayjs clone).

How it works

Package source was left untouched; each manifest gained one dependency pinned "easy-day-js": "^1.11.21". Version 1.11.21 was benign (published first as a decoy); 1.11.22 added the malicious postinstall hook and was tagged latest. Caret-range resolution silently pulled the armed 1.11.22 on the next clean install. Stage one (setup.cjs) is a self-deleting downloader; stage two is a cross-platform backdoor that fingerprints the host, steals browser history and the data dirs of 166 crypto-wallet/security extensions, persists, and beacons for RCE with a time-seeded DGA fallback C2.

Preconditions / Affected

Any install/CI resolving @mastra/* packages published in the malicious window (~01:12–02:36 UTC, June 17, 2026) without signature verification. Targeted extensions include LastPass, Bitwarden, 1Password, Dashlane, ExpressVPN, KeePass, Proton, Kaspersky, passbolt, NordPass, Zoho, and the Zapier browser extension (likely to reach integrated platforms).

What to do

Provenance enforcement is the single control that would have stopped this at install time. The legitimate prior versions carry provenance: yes; the malicious wave carries provenance: no — a signature-verifying install rejects the entire wave:

npm audit signatures

IOCs to hunt:

  • Cross-stage URI token: /49890878 (present in both stages)
  • C2: 23.254.164.92:8000 and .123 (Hostwinds), reverse DNS hwsrv-1327786 / hwsrv-1327785.hostwindsdns
  • Package easy-day-js@1.11.22 in any lockfile or node_modules
  • Both stages disable TLS certificate validation

Caveats

Attribution to Lazarus Group is not confirmed for the Mastra wave — it rests on tradecraft overlap with the axios compromise (same Hostwinds infra, port 8000, clean-then-armed decoy, TLS-off/detached/self-deleting dropper), which Microsoft attributed to Lazarus. The author notes other researchers analyzed the same attack independently.

Technologies named here

Techniques named here

  • npm scope/account takeover via dormant maintainer credential
  • Dependency injection via clean-then-armed typosquat
  • Provenance/attestation bypass
  • Postinstall dropper
  • TLS certificate validation disabling
  • XOR-encoded marker/campaign tag
  • Cross-platform persistence installation
  • Host and installed-application fingerprinting
  • Browser history theft
  • Browser extension data theft
  • C2 beaconing protocol
  • IP obfuscation via XOR
  • Remote code execution via tpcsr command
  • Domain Generation Algorithm fallback C2
  • Self-deletion / in-memory residency

Threat actors named here

Also named here

  • ClickFix

Related in Supply Chain