Sapphire Sleet compromised the `ehindero` npm maintainer account and injected the malicious `[email protected]` dependency into 144 Mastra AI npm packages during an 88-minute window on June 17, 2026. The postinstall hook executed an obfuscated JavaScript dropper that downloaded a cross-platform tasking client, established persistence on Windows, macOS, and Linux, and polled attacker infrastructure for commands. The payload targeted 166 browser cryptocurrency wallet extensions and exposed browser data, secrets, tokens, and CI/CD environment credentials. Microsoft attributed the Mastra supply-chain compromise to Sapphire Sleet, a North Korean group focused on cryptocurrency theft and developer toolchains.