Mastra AI npm Scope Compromise (Sapphire Sleet / UNC1069)

144+ packages across the `mastra` and `@mastra` npm scope; `@mastra/core` draws more than 918,000 weekly downloads

The entire scope was backdoored in an 88-minute automated campaign; a malicious `easy-day-js` typosquat of dayjs ran a `postinstall` dropper that disabled TLS verification, contacted a C2, and downloaded a detached cross-platform information stealer that harvested browser history and 160+ cryptocurrency wallet extensions before self-deleting

Takeover of a dormant former-contributor npm account (`ehindero`) that still held publish rights, reached via a malicious LinkedIn link to an active employee; Microsoft attributed it to North Korean actor Sapphire Sleet (UNC1069), the same actor behind the earlier Axios compromise