593 reports
An attacker compromised the @mastra npm organization and republished more than 140 Mastra ecosystem packages with a dependency on the typosquatted `easy-day-js` package. The malicious `[email protected]` release used a postinstall dropper to disable TLS…
A compromised Mastra maintainer account was used to publish 116 malicious npm packages, mostly under the `@mastra/` namespace, with a postinstall script designed to exfiltrate credentials and remove itself. Mastra identified the attack the evening of June…
A malicious npm dependency, easy-day-js, was added to 143 Mastra packages as a production dependency, causing fresh installs to resolve from a clean decoy version to weaponized [email protected] through a caret version range. Its obfuscated postinstall …
A compromised Mastra npm release wave added the typosquatted dependency `easy-day-js`, whose `postinstall` hook executed during dependency installation and pulled a second-stage Node.js implant from attacker-controlled infrastructure. The implant installe…
An attacker reused a dormant former Mastra contributor npm account to republish 143 @mastra packages on June 17, 2026, adding a dependency on easy-day-js that resolved to a malicious postinstall version. The dropper fetched a second-stage Node RAT from Ho…
Sapphire Sleet compromised the Mastra npm ecosystem by taking over the `ehindero` maintainer account and injecting the malicious `easy-day-js` typosquat into more than 140 `mastra` and `@mastra` packages. The weaponized package ran a postinstall dropper t…
AhnLab observed malicious Windows LNK files disguised as resumes that show a benign decoy document while creating batch, PowerShell, and VBScript files under public user directories. The chain registers an `office365` scheduled task to run every 10 minute…
AhnLab observed a malicious Windows shortcut disguised as a personal information consent document that runs obfuscated PowerShell and retrieves additional scripts for fileless execution. The chain creates downloader and loader PowerShell scripts, establis…
Checkmarx identified ChainVeil, an npm typosquatting campaign attributed to an actor it calls SuccessKey that distributed at least nine malicious packages containing a shared import-time loader. The loader used Tron, Aptos, and Binance Smart Chain transac…
A stale former contributor npm account was used to republish the Mastra npm scope with a malicious `easy-day-js` dependency that executed at install time. The dropper disabled TLS validation, fetched a second-stage payload from a raw IP, and installed a c…
North Korean APT activity in May 2026 emphasized developer and software-supply-chain abuse: Lazarus weaponized Git Hooks and Jenkins CI/CD workflows to spread InvisibleFerret, BeaverTail, and FCCCall, raising risks to developer credentials and cryptocurre…
ESRC found that the malicious npm package chai-as-init, distributed in versions 1.4.5 through 1.4.7, impersonated a Chai.js plugin while hiding malicious code in only two files copied into a mostly legitimate-looking pino package tree. Loading the package…
A spear-phishing email impersonating Bithumb reportedly led to malware infection on a Humanity Protocol director's Windows laptop, exposing MetaMask data and production signer keys in activity Quantstamp said was characteristic of DPRK intrusions. With th…
Nisos identified a DPRK state-sponsored employment fraud cell that submitted more than 170,000 job applications to US companies between December 2024 and September 2025, producing 76 employment offers across 22 operatives. The operation used appropriated …
North Korea-linked activity in AhnLab's May 2026 APT trend report centered on developer and software-supply-chain intrusion paths. Lazarus abused Git hooks and Jenkins CI/CD workflows to trigger InvisibleFerret, BeaverTail, and FCCCall infections aimed at…