Sapphire Sleet compromised a Mastra maintainer and used retained npm publishing access with an MFA token bypass to republish more than 140 `@mastra` packages with the malicious `easy-day-js` dependency. Its obfuscated post-install dropper contacted `23.254.164.92:8000` to retrieve a second stage and recorded installation paths for victim mapping before deleting itself. Microsoft assessed that the North Korean actor sought LLM API keys, cloud credentials, database connection strings, and CI/CD secrets, with cryptocurrency theft as the primary motivation. Systems that installed affected Mastra packages after June 16, 2026 were considered potentially compromised.