DeepFalcon — Daily Threat Intelligence Report

Threat Landscape Summary — June 18, 2026

One qualifying critical finding for June 18 — a large-scale, highly sophisticated npm supply-chain attack. On June 17, an attacker hijacked the npm account of a former Mastra framework contributor whose publishing access had never been revoked, then ran an 88-minute automated campaign republishing 144 packages across the entire @mastra namespace — the open-source AI application framework with over 1.1 million combined weekly downloads. The packages themselves were untouched; instead, each was quietly given a new dependency on "easy-day-js," a typosquat clone of the popular dayjs library that was published clean a day earlier specifically to pass casual review, then weaponized hours before the mass-republish. The payload disables TLS validation, fetches a second-stage cross-platform credential-and-cryptocurrency-wallet stealer from a raw IP address, and self-deletes to erase forensic evidence. No CVE was ever assigned to this attack — meaning CVE-based vulnerability scanners had zero detection surface while it was actively exploited. A Strong Lead below covers a related but separately disclosed campaign: malicious JetBrains Marketplace plugins stealing AI provider API keys from developers.

> Coverage windowJun 17 3:30 PM — Jun 18 7:30 AM ET

> Category A qualifying findings0

> Category B (supply chain/LotL) findings1 — Mastra npm / easy-day-js

> Packages compromised144 (@mastra/* + mastra + create-mastra)

> Weekly download exposure1.1M+ (core alone: 918K)

> Strong Leads (Section 11)1 — JetBrains Marketplace AI key theft

CRITICAL ★ Mastra npm Supply-Chain Attack — Hijacked Contributor Account Used to Backdoor 144 AI Framework Packages via Typosquat Dependency "easy-day-js" — Cross-Platform Crypto-Wallet Stealer, Zero CVE Assigned, 1.1M+ Weekly Downloads Exposed Critical 🔧 Supply Chain / LotL 🤖 AI-Adjacent ▼

Affected Products

All 144 packages under the @mastra/* npm scope plus the top-level "mastra" and "create-mastra" packages. Mastra is an open-source JavaScript/TypeScript framework for building AI applications. Highest-impact single package: @mastra/core at approximately 918,000 weekly downloads; combined ecosystem exposure exceeds 1.1 million weekly downloads.

Root Cause — Stale Contributor Access

The attacker hijacked the npm account "ehindero," a legitimate former Mastra contributor whose publishing access to the @mastra scope had never been revoked after they stopped contributing. npm does not automatically expire scope-publish permissions on inactivity, meaning one stale credential was sufficient to compromise the entire package scope.

The Typosquat Mechanism — Why This Evaded Review

A second account, "sergey2016," published "easy-day-js" — a near-exact clone of the legitimate "dayjs" date library (40M+ weekly downloads), copying its author name, homepage, repository URL, license, and version numbering. The first version (1.11.21, published June 16 at 07:05 UTC) was completely clean. The @mastra packages were updated to depend on "easy-day-js": "^1.11.21" — a caret range. When the attacker published version 1.11.22 with the malicious payload at June 17, 01:01 UTC, npm's caret-range resolution automatically pulled the new malicious version into every fresh install without any further changes needed to the @mastra packages themselves.

Attack Timeline

June 16, 07:05 UTC: clean decoy "easy-day-js" 1.11.21 published. June 17, 01:01 UTC: malicious 1.11.22 published with obfuscated postinstall hook. 01:12–02:39 UTC (88 minutes): automated campaign republishes 144 packages across the @mastra scope, starting with @mastra/schema-compat and rapidly covering @mastra/core, memory, server, loggers, observability, deployer, the top-level "mastra" package, and infrastructure packages (pg, mcp, libsql, evals, rag, datadog).

Technical Mechanism — Dropper Stage

The "postinstall": "node setup.cjs --no-warnings" hook runs automatically during npm install, before a developer ever imports the package. The obfuscated setup.cjs disables TLS certificate validation, fetches a second-stage payload from a raw IP address over HTTPS (bypassing certificate pinning), executes it as a detached background process with no console output, then deletes itself to erase the forensic trail.

Technical Mechanism — Second-Stage RAT

The final payload is a cross-platform Node.js information-stealer and remote access trojan. It harvests browser history from Chrome, Brave, and Edge; inventories 160-166 cryptocurrency wallet browser extensions (MetaMask, Phantom, Coinbase, Binance, and others); installs OS-level persistence on Windows, macOS, and Linux using Node/NVM-themed naming to blend in; and opens a polling-loop C2 channel that can download and execute arbitrary follow-on modules — meaning the attacker's capabilities are not fixed at infection time and can be expanded remotely at any point.

Zero-CVE Detection Gap

No CVE was assigned to this campaign — consistent with a broader pattern researchers at Phoenix Security have tracked across 60 similar npm/PyPI/VS Code/AI-tooling supply-chain campaigns from June 2024 to June 2026, all without CVE assignment. This means traditional CVE-based vulnerability scanners had no detection surface whatsoever during active exploitation; only behavioral and runtime-monitoring tools (Socket, JFrog Curation, StepSecurity Harden-Runner) caught this in near-real-time.

Attribution (Unconfirmed)

No formal attribution has been made. However, multiple researchers (Snyk, SafeDep) note the tradecraft — Hostwinds hosting infrastructure, a clean-then-armed typosquat strategy, the TLS-disabled raw-IP fetch, detached process spawning, self-deletion, and a crypto-wallet-focused stealer — closely matches the earlier 2026 Axios npm compromise, which Microsoft attributed to Sapphire Sleet (BlueNoroff), a North Korea-linked threat group.

IOCs — Published by Socket, StepSecurity, SafeDep, JFrog, OX Security, Orca · June 17, 2026

🔴 Malicious npm package: easy-day-js (versions 1.11.22 and later are malicious; 1.11.21 was a clean decoy)

🔴 Dropper C2: 23.254.164[.]92:8000/update/49890878 (User-Agent gated — only responds to Node's default UA; browsers receive 404)

🔴 RAT C2: 23.254.164[.]123:443 (HTTPS POST beacons, ~10-minute interval, confirmed still live at research time)

🔴 Compromised/attacker npm accounts: ehindero (hijacked), sergey2016 (published malicious package)

🔴 Dropper file: setup.cjs (obfuscated postinstall script)

🔴 Hosting: Hostwinds — hwsrv-1327786 / hwsrv-1327785.hostwindsdns.com, IP block 23.254.164.0/24

🔴 RAT C2 TLS certificate: CN=www.wolfssl.com (expired January 2018 — used to impersonate the legitimate wolfssl.com)

Second-stage payload SHA256 (partial, as published): 221c45a7...badf (41KB obfuscated script). Full hash and additional artifacts available from source publications below.

▶ Defensive Actions

1. If you installed any @mastra/* package, "mastra," or "create-mastra" since June 16, 2026, treat the machine as compromised — do not assume removing node_modules is sufficient, since the RAT installs OS-level persistence separate from the npm package itself.
2. Roll back to a pre-incident package version and verify the "easy-day-js" dependency is no longer present in your lockfile.
3. Rotate every credential the affected machine could reach — cloud provider keys, LLM/AI API keys, CI/CD tokens, database connection strings, and especially cryptocurrency wallets, given the stealer's explicit targeting of 160+ wallet browser extensions.
4. Audit for persistence artifacts using Node/NVM-themed naming conventions on Windows, macOS, and Linux hosts that ran npm install during the exposure window.
5. Block the published C2 indicators (23.254.164.0/24) at the network/firewall level immediately.
6. Treat this as a wake-up call on contributor access hygiene for your own internal package scopes if you publish to npm — implement mandatory MFA and automated revocation of publish access for inactive contributors, since this entire campaign was enabled by exactly that gap.

MITRE ATT&CK TTPs

T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain) · T1078 (Valid Accounts — hijacked npm publisher credentials) · T1059.007 (Command and Scripting Interpreter: JavaScript/Node.js) · T1027 (Obfuscated Files or Information) · T1070.004 (Indicator Removal: File Deletion — self-delete) · T1547.001 (Boot or Logon Autostart Execution — Node/NVM-themed persistence) · T1555.003 (Credentials from Password Stores: Credentials from Web Browsers) · T1071.001 (Application Layer Protocol: Web Protocols — HTTPS C2)

References: The Hacker News — June 17, 2026 · StepSecurity — Technical Breakdown · SafeDep — Full IOC List & Attribution Notes · OX Security · Orca Security · SC Media

Technique ID	Technique Name	Tactic	Observed In
T1195.002	Supply Chain Compromise — Software Supply Chain	Initial Access	Mastra npm scope compromise via dependency injection
T1078	Valid Accounts	Initial Access / Persistence	Hijacked "ehindero" npm publisher account with never-revoked scope access
T1059.007	Command and Scripting Interpreter — JavaScript	Execution	Node.js postinstall dropper (setup.cjs)
T1027	Obfuscated Files or Information	Defense Evasion	Obfuscated dropper script; typosquat package mirroring legitimate dayjs metadata
T1070.004	Indicator Removal — File Deletion	Defense Evasion	Dropper self-deletes after spawning detached background process
T1547.001	Boot or Logon Autostart Execution	Persistence	Node/NVM-themed persistence across Windows, macOS, Linux
T1555.003	Credentials from Web Browsers	Credential Access	Browser history and cryptocurrency wallet extension data harvesting
T1071.001	Application Layer Protocol — Web Protocols	Command and Control	HTTPS POST beaconing to RAT C2, ~10-minute interval

Campaign	Category	Actor	Platform	Sector	Impact	IOCs	First Reported	Priority Action
Mastra npm Supply Chain — easy-day-js Typosquat	🔧 Supply Chain⛓ Zero-CVE	Unattributed — tradecraft overlaps with Sapphire Sleet (BlueNoroff), unconfirmed	npm / Mastra AI framework	Any org with developers building on Mastra — AI/cloud development teams especially at risk	Critical	✓ 7 IOCs	2026-06-17 (Socket / The Hacker News / StepSecurity)	Treat affected machines as compromised · rotate all credentials · block C2 IPs

🔬 RESEARCH Malicious JetBrains Marketplace Plugins Steal AI Provider API Keys From Developers — 15 Plugins, 7 Vendor Accounts, ~70,000 Downloads — Plus Companion Discovery of "PromptSnatcher" Chrome Extensions Capturing AI Chatbot Conversations — Aikido Security

Aikido Security disclosed a coordinated campaign of at least 15 malicious JetBrains Marketplace plugins, published under seven different vendor accounts, that pose as fully functional AI coding assistants built on DeepSeek, OpenAI, and SiliconFlow models — offering chat, commit message generation, code review, and unit test creation exactly as advertised. The plugins work as intended, but the moment a developer enters an AI provider API key into the settings and clicks "Apply," the key is silently exfiltrated over HTTP to a hardcoded attacker server, with no prompt or consent indication anywhere in the interface. Active since October 2025 with new plugins still appearing as recently as June 10, 2026, the campaign has amassed roughly 70,000 cumulative downloads, though Aikido cautions that figure may be inflated. BleepingComputer independently confirmed the credential-theft code remains present in the most-downloaded plugin, "DeepSeek AI Assist," which was still live on the Marketplace at time of publication.

The bizarre paid-tier twist: after a small payment through a built-in donation wall, the operators send paying users a "working" API key for their model calls — researchers theorize these are keys harvested from free-tier victims, effectively turning the campaign into a service that resells stolen AI credentials back to other users. Companion finding: the same reporting cycle surfaced two Chrome ad-blocker extensions, codenamed "PromptSnatcher" by independent researcher Jean-Marie R., caught capturing user conversations with ChatGPT, Claude, Gemini, Copilot, Perplexity, Grok, and Meta AI.

Detection guidance: search network logs for 39.107.60[.]51, and the paths /api/software/key and /api/software/check. If a key was entered into any affected plugin, assume it was compromised even without confirming network logs, and rotate it.

The Hacker News / BleepingComputer / Aikido Security / SC Media / Infosecurity Magazine · June 16, 2026 · → Read more — The Hacker News

AI Development Tooling Is Becoming a Premium Supply-Chain Target

Today's main finding and Strong Lead, while structurally different, point at the same underlying trend: attackers are deliberately targeting the tools developers use to build AI applications, not just the AI applications themselves. The Mastra attack succeeded because AI framework packages now sit at the intersection of cloud infrastructure and credential-rich environments — researchers explicitly noted that Mastra packages are "routinely installed in environments that hold some of the most sensitive credentials," including LLM API keys, cloud provider tokens, and CI/CD secrets. The JetBrains plugin campaign targeted the same prize from a different angle: rather than compromising the framework, it compromised the moment a developer hands over an AI API key to a tool they trust.

This concentration of high-value secrets in AI development workflows — combined with the zero-CVE structural gap researchers have now documented across 60+ similar campaigns since mid-2024 — means traditional vulnerability management processes built around CVE feeds are structurally blind to this entire threat category. Organizations building on AI frameworks or relying on AI-assisted development tooling should treat dependency provenance, contributor access hygiene, and runtime behavioral monitoring as core security controls, not optional add-ons, specifically because the CVE pipeline cannot be relied upon to surface these attacks while they are active.