Sapphire Sleet attacks the npm supply chain: it steals credentials and crypto through compromised units

Microsoft has with high confidence attributed to the operation the recent commitment of the supply chain of Mastra in npm to the North Korean threat known as Sapphire Sleet (BlueNoroff), after a malicious actor took control of a maintenance account and published updates that introduced a malicious dependence. The exploited vector combines classic techniques of typosquating- the fraudulent dependence "easy-day-js" imitated the popular dayjs bookstore - with the abuse of the installation hook to run a dropper looking for credentials and cryptomoneda keys in development environments.

The technical mechanism is especially harmful to developer environments: the installation of compromised packages triggered a post-install hole which deployed a dropper opfuscado, deactivated the TLS verification, contacted control and control servers and downloaded a second multiplatform stage. That second binary acts as a stealer able to cover Windows, macOS and Linux, list processes and browser extensions and check the presence of up to 166 extensions of wallets(MetaMask, Phantom, Coinbase Wallet, among others), as well as establishing persistence through registration keys, LaunchAgens or systemd services according to the system.

The activity profile and re-use of tactics, techniques and procedures - including a backdoor in PowerShell and the creation of exclusions in Microsoft Defender - are consistent with previous campaigns attributed to Sapphire Sleet, and fit the group's known motivation: the theft of critical assets and credentials. This incident is not isolated: Microsoft had already identified other commitments in the npm ecosystem during 2026, which shows a trend of state actors exploiting confidence in maintainers and open source packages.

The implications are multiple. In technical terms, compromising a maintainer account or a wide scope like @ mastra allows to distribute malicious code to many projects practically automatically, turning developers into vectors for the exfiltration of secrets and tokens. At the organizational level, it erodes confidence in the software supply chain: organizations that incorporate units without additional controls risk introducing back doors, loss of funds and exposure of corporate credentials.

The immediate measures that teams and developers should take include revoking tokens and credentials that may have been exposed, audiating development machines and CI by persistencies and commitment indicators, and rebuilding from clean artifacts if there is a suspicion of infection. It is also critical to remove or freeze compromised versions in the records and to communicate to the affected community to avoid further facilities.

In parallel, controls should be applied to reduce the likelihood and impact of future incidents: multifactor authentication and minimum access policies in publishing accounts, limit and rotate publication tokens with attached privileges, and deploy package integrity verification (Lockfiles and Checksums) in CI pipelines. Disable post-install hooks in automated environments or run them in controlled sandboxes reduces the exploitable surface by malicious packages.

Software composition analysis tools (SCA), package signing, access control private records and SBOMs generation help to detect and contain compromised dependence before they reach production. In addition, attack simulation tests and outbound traffic monitoring can identify communications with C2 infrastructure and early exfiltration patterns. For practical guidance on supply chain security, organizations can review the official recommendations of specialized agencies such as CISA: https: / / www.cisa.gov / supply-chain.

Packaging maintainers and administrators are also responsible: using robust passwords and 2FA, reviewing account activity with publication permits and auditioning unit changes before accepting updates is essential. npm publishes guides and good practices that any computer that depends on the Javascript ecosystem should follow: https: / / docs.npmjs.com /.

This episode reiterates that the security of modern software depends on both individual hygiene (credentials, MFA, isolated environments) and organizational controls (dependency policies, safe CI, monitoring and response). To adopt an in-depth defence and to prepare response procedures that include the rotation of secrets and the reconstruction of assets is committed to the ability to contain sophisticated campaigns such as those attributed to Sapphire Sleet.