3rd Party Risk Management , Governance & Risk Management

Open-source artificial intelligence framework Mastra has been compromised by North Korean hackers who planted infostealers, adding yet another supply-chain attack on package managers.

See Also: Securing Microsoft 365: A Live Breakdown of Modern Attack Paths

Attackers, attributed by Microsoft on Wednesday to a group tracked as BlueNoroff or Sapphire Sleet, breached a Mastra npm maintainer account and published malicious versions of more than 140 packages, Microsoft said. The campaign effectively spread malware into downstream software development pipelines that use the framework to build AI applications and agents.

Software developers for months now have weathered a spate of supply-chain attacks targeting JavaScript packages hosted on npm, the package registry maintained by Microsoft's GitHub, including waves of Shai-Hulud attacks, a self-replicating worm built by TeamPCP that later sparked copycat campaigns (see: Flurry of Supply-Chain Software Library Attacks).

The torrent of attacks has prompted GitHub to tighten security measures. The code hosting platform announced Thursday it will turn off privileged workflows that check out and execute code from untrusted pull requests in the newest version of actions/checkout.

"The Mastra incident is a strong signal that state-sponsored groups are deliberately shifting their focus toward AI development frameworks as a way to breach corporate networks at scale," said Principal Security Engineer Boris Cipot at Black Duck, a software supply-chain security firm.

"AI toolchains are deeply embedded in development workflows and often run inside CI/CD pipelines that hold sensitive credentials, API keys and access to production systems. Targeting this layer allows attackers to move beyond traditional endpoint compromise and instead gain a foothold directly in the software supply chain," Cipot said.

The actor behind the Mastra attack is an affiliate of North Korea's Lazarus Group. Unlike some Lazarus operations focused on espionage, BlueNoroff has been associated with financially motivated campaigns around the globe designed to generate revenue for Pyongyang.

The group had used social engineering on social media sites such as LinkedIn to steal cryptocurrency. In recent months, it shifted focus toward software supply-chain attacks, stealing credentials and targeting technology or intellectual property related to cryptocurrency trading and blockchain platforms.

In April, the actor conducted a separate npm supply-chain compromise affecting Axios, a popular JavaScript HTTP client. Given the consistency in infrastructure and post-compromise tactic, techniques and procedures, Microsoft Threat Intelligence attributed the latest attack on Mastra to BlueNoroff with high confidence.

"The compromise originated from the takeover of the ehindero npm maintainer account, which had publish rights across the Mastra ecosystem and was used to publish poisoned package versions that introduced easy-day-js, a malicious typosquat of the popular dayjs library," Microsoft wrote.

Day.js is a legitimate library for working with dates and times, such as formatting timestamps, which Mastra uses as a dependency. The lightweight file received more than 59 million downloads in the past week.

Developers and CI/CD pipelines automatically installed compromised versions of the dependency into their projects, propagating a postinstall hook that disabled TLS verification, dropped tracking markers and contacted command and control infrastructure.

The hook downloaded and executed a Node.js backdoor that profiled infected machines, stole credentials, cryptocurrency wallet information and browser data, communicated with attacker servers, and enabled the delivery of additional malware.

On systems with established command and control communication, the threat actor delivered a PowerShell backdoor for additional persistence and privilege escalation.

"A postinstall hook executes before anyone questions it, and if long-lived tokens, cloud keys and API credentials are sitting in that build environment, the attacker does not need a second foothold," said Shane Barney, chief information security officer at zero trust platform Keeper Security.

"Secrets should not persist in build environments beyond the scope of a single job. Pipelines should operate on least-privilege access, and that access should be ephemeral by design rather than revoked after the fact. When the next compromised package lands, the blast radius should be bounded by architecture, not discovered during incident response," Barney said.

A day after Microsoft disclosed the Mastra attack, GitHub released a new default protection aimed at a persistent GitHub Action supply-chain risk called "pwn request", where malicious code from an external pull request exploits privileged CI/CD workflows to steal secrets or alter the main repository.

"Checkout now refuses to check out fork pull request code by default when the workflow is triggered by pull_request_target or workflow_run. These triggers run with the base repository's GITHUB_TOKEN, secrets and runner access, where executing a fork's code commonly leads to 'pwn request' vulnerabilities," the action's description said.

While GitHub's update addresses one avenue for supply-chain compromise, organizations need controls to limit the impact of malicious package updates, Cipot said. One such measure is strict version locking, which forces dependency upgrades through a review process instead of allowing new package versions to be pulled in automatically.

It also helps to route software dependencies through an internal artifact proxy to delay access, which "creates a time buffer in which malicious releases can be identified, flagged and removed before they ever reach internal environments," Cipot said.