From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet

In this article 1. Attack chain overview 1. Discovery and initial indicators 2. Dependency injection: the poisoned package.json 3. Typosquat analysis: easy-day-js 4. Staged delivery pattern 5. Obfuscation and payload analysis 6. TLS bypass to self-deletion 7. Timeline analysis 2. Who is Sapphire...

MAL-2026-5979 Malicious code in easy-day-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8602a5a154b50bb6351900a08fa45d7814c0f152e4379dcae53ccfa0b83db891 Package name 'easy-day-js' impersonates the popular 'dayjs' library, copying dayjs's author 'iamkun', homepage https://day.js.org, repository URL,...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. An attacker using the npm account ehindero hijacked the @mastra npm organization and, in a roughly 30–45 minute burst starting around 01:12 UTC, republished the entire @mastra catalog. The Mastra source code was...

Malicious code in dayjs-plugin-duration (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38d6c09f6f8900e2be647537f5342bb545a0ee4b4affee0e47006cc43da3d489 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3619 Malicious code in dayjs-plugin-duration (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38d6c09f6f8900e2be647537f5342bb545a0ee4b4affee0e47006cc43da3d489 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-2065 Malicious code in @realty-front/dayjs (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-7079 Malicious code in @ozon-shared-deps/dayjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in ember-power-calendar-dayjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 71ddea44645d593def41662f97e74c980145082e9cb59e599c1e14a713eb2258 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1029 Malicious code in ember-power-calendar-dayjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 71ddea44645d593def41662f97e74c980145082e9cb59e599c1e14a713eb2258 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview @realty-front/dayjs is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packa...