2026-06-17
Microsoft
From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet
#Mastra
#NPM
#SapphireSleet
Microsoft
Actors
| Name | Named by | AKA | First seen | Last seen |
|---|---|---|---|---|
| Cerium | Microsoft | Kimsuky | 2021-10-07 | 2022-11-07 |
| CitrineSleet | Microsoft | Lazarus | 2023-10-06 | 2025-03-27 |
| Copernicium | Microsoft | APT38 | 2022-11-07 | 2022-11-07 |
| CoralSleet | Microsoft | Storm-1877 | 2026-03-06 | 2026-03-06 |
| DEV-0139 | Microsoft | Lazarus | 2022-12-06 | 2022-12-06 |
| DEV-0215 | Microsoft | ScarCruft | 2022-11-07 | 2022-11-07 |
| DEV-0530 | Microsoft | Plutonium | 2022-07-14 | 2022-07-14 |
| DiamondSleet | Microsoft | Zinc | 2023-04-19 | 2024-02-27 |
| EmeraldSleet | Microsoft | Thallium | 2023-04-19 | 2026-03-06 |
| JadeSleet | Microsoft | TraderTraitor | 2023-07-18 | 2024-10-15 |
| JasperSleet | Microsoft | FamousChollima | 2025-06-30 | 2026-04-21 |
| Lawrencium | Microsoft | DEV-0215 | 2023-04-18 | 2023-04-18 |
| MoonstoneSleet | Microsoft | Lazarus | 2024-05-28 | 2025-11-24 |
| OnyxSleet | Microsoft | Plutonium | 2023-04-19 | 2024-09-11 |
| OpalSleet | Microsoft | Osmium | 2023-04-19 | 2023-10-06 |
| Osmium | Microsoft | Konni | 2021-10-07 | 2022-11-07 |
| PearlSleet | Microsoft | Lawrencium | 2023-04-19 | 2023-04-18 |
| Plutonium | Microsoft | Andariel | 2022-11-07 | 2022-11-07 |
| RubySleet | Microsoft | Cerium | 2023-04-19 | 2025-05-14 |
| SapphireSleet | Microsoft | Copernicium | 2023-04-19 | 2026-06-17 |
| Sleet | Microsoft | - | 2023-04-19 | 2025-06-03 |
| Storm-0287 | Microsoft | JasperSleet | 2025-06-30 | 2025-06-30 |
| Storm-0530 | Microsoft | DEV-0530 | 2023-04-19 | 2023-04-18 |
| Storm-1789 | Microsoft | MoonstoneSleet | 2024-05-28 | 2024-05-28 |
| Storm-1877 | Microsoft | - | 2024-05-28 | 2024-05-28 |
| Thallium | Microsoft | Kimsuky | 2019-12-30 | 2022-02-16 |
| Zinc | Microsoft | Lazarus | 2017-12-19 | 2022-11-22 |