AI development moves fast. So do the attackers targeting it — and they are no longer waiting for vulnerabilities to appear. They are injecting themselves directly into the tools developers trust.

Microsoft has attributed the recent Mastra AI supply chain attack to Sapphire Sleet — a North Korean state-sponsored hacking group also known as BlueNoroff. Attackers compromised an npm maintainer account with publishing privileges across the Mastra package ecosystem, then pushed malicious updates to more than 140 packages. The payload injected a typosquatted dependency called “easy-day-js” that deployed a cross-platform credential stealer targeting developer machines running Windows, Linux, and macOS. The malware harvested browser histories, API keys, authentication tokens, and checked for 166 cryptocurrency wallet extensions — including MetaMask, Phantom, and Binance Wallet.

Here is what security leaders need to understand: This is not just another supply chain attack. It is a precision strike against the AI development pipeline. Mastra is a framework for building AI agents — autonomous software that interacts with systems, accesses data, and makes decisions on behalf of users. By compromising its package ecosystem, attackers did not just target code repositories. They targeted the identity fabric that AI agents rely on to access everything else. Developer credentials stolen during a build today become the keys to production databases, cloud infrastructure, and customer data tomorrow.

The sophistication is worth noting. Sapphire Sleet disabled TLS certificate verification, contacted C2 infrastructure, deployed a second-stage payload as a detached hidden process, and established persistence through OS-specific mechanisms — Windows Registry Run keys, macOS LaunchAgents, and Linux systemd services. On compromised systems, they followed up with PowerShell backdoors, Microsoft Defender exclusions, and malicious services running with SYSTEM privileges. This was not a smash-and-grab. It was a methodical operation.

What security leaders should do:

• Audit AI/ML package dependencies with the same rigor you apply to production infrastructure dependencies. If your developers are building with AI frameworks, those supply chains are in your threat model — whether you put them there or not.
• Enforce MFA on all package registry maintainer accounts. The Mastra attack began with a single compromised npm account. One maintainer, no MFA, 140+ packages poisoned. This is a governance failure, not a technical one.
• Treat AI agent credentials as privileged identities. An AI agent running on a developer’s token does not become less dangerous because the developer trusts it. Just-in-time access, short-lived tokens, and least-privilege scoping apply here too.
• Monitor for anomalous package updates — new dependencies appearing in lockfiles, unexpected version bumps, maintainer account changes. Supply chain attacks succeed because they look like normal dev activity until they do not.

The AI supply chain is the identity supply chain. Secure one, and you secure the other. Ignore the connection, and you hand attackers the keys to both.

Disclaimer: This post was researched and written by AI agents working with Philip Sow. Every source is linked so you can check the facts. Views are personal and do not represent any employer.

#AISecurity #SupplyChain #IdentitySecurity #ThreatIntel #CyberSecurity

Source: Bleeping Computer — Lawrence Abrams, June 20, 2026