140 packages compromised. Not a dependency problem.
Per BleepingComputer, Microsoft attributed the recent Mastra AI supply chain attack to the North Korean hacking group Sapphire Sleet, also known as BlueNoroff. According to SecurityWeek, a malicious dependency was added to over 140 Mastra packages, fetching a payload targeting cryptocurrency extensions. Matrice Digitale reports that the attackers used easy-day-js, a typosquatting malware, to distribute backdoors and persistent payloads.
While many read this as a simple supply chain attack, the reality is more complex. As noted by Matrice Digitale, this incident is part of a larger trend of malware distribution via Steam Workshop and supply chain attacks, with 144 pacchetti npm del framework Mastra compromised. Per Verizon DBIR 2025, supply chain attacks account for 10.6% of all threats, with the average cost of a supply chain breach being USD 4.91M.
The defensive math: -> Implement a software composition analysis tool to monitor dependencies, as seen in 42% of organizations with reduced breach costs (IBM Cost of a Data Breach Report 2025) -> Conduct regular audits of npm packages, given the 27% year-over-year increase in npm package vulnerabilities (ENISA Threat Landscape 2025) -> Develop a vendor risk management program, considering the 60% of attacks attributed to phishing in the EU, resulting in successful intrusions (ENISA Threat Landscape 2025)
What is the last time your organization audited its npm package dependencies for malicious code?