← Back to feed
2026-08-05 Supply ChainNation StateMalware TLP:CLEAR

CrowdStrike 2026 Threat Hunting Report: STARDUST CHOLLIMA DPRK Supply Chain Campaign Targets Mastra AI Framework via npm Poisoning

Date: 2026-08-05
Tags: supply-chain, nation-state, malware

Executive Summary

CrowdStrike's 2026 Threat Hunting Report, published 2026-08-03, attributes a June 2026 npm dependency injection against the Mastra AI framework to DPRK-nexus STARDUST CHOLLIMA, the same actor CrowdStrike tied to the March 2026 Axios npm compromise. Independent June 17 reporting by Aikido and StepSecurity identified the injected dependency as [email protected], a dayjs typosquat whose postinstall hook fetched a second-stage payload from 23.254.164.92. Block easy-day-js, hunt those C2 addresses, and do not treat the Mastra framework name itself as an indicator.

Campaign Summary

FieldDetail
Campaign / MalwareSTARDUST CHOLLIMA Mastra npm dependency injection via easy-day-js
Actor / AttributionSTARDUST CHOLLIMA, DPRK-nexus, CrowdStrike attribution, confidence high. Aikido and StepSecurity documented the package and C2 without naming the actor.
TargetDevelopers and CI installing Mastra AI framework npm packages
VectorCompromised @mastra npm publishing; caret dependency on easy-day-js resolving to a postinstall dropper
StatusJune 2026 compromise as reported; CrowdStrike did not publish current registry status
First Observed2026-06-16 bait package; 2026-06-17 mass republish of Mastra packages

Detailed Findings

According to CrowdStrike's 2026-08-03 blog on the Threat Hunting Report, STARDUST CHOLLIMA used stolen maintainer credentials in March 2026 to compromise the Axios npm package and deliver platform-specific ZshBucket malware. In June 2026, CrowdStrike reported, the same adversary injected a malicious npm package as a dependency into at least 131 Mastra AI framework packages. CrowdStrike's press release on the same day used the same 131-package figure and said 87 percent of identified software registry threats in the first half of 2026 involved malicious npm packages.

CrowdStrike's public blog and press release do not name the injected package, publish hashes, or list C2. Those details come from Aikido Security and StepSecurity, who published technical write-ups on 2026-06-17, the day of the Mastra republish. Aikido counted 141 republished packages between 01:15 and 02:00 UTC, including [email protected], [email protected], and @mastra/[email protected]. StepSecurity counted 140-plus packages over an 88-minute window starting 01:12 UTC. The CrowdStrike 131 figure and the Aikido 141 figure are not reconciled in public reporting; treat them as separate snapshots of the same incident class.

According to Aikido and StepSecurity, npm user sergey2016 published [email protected] on 2026-06-16 as a clean copy of dayjs, then published [email protected] on 2026-06-17 with a postinstall hook running obfuscated setup.cjs. Compromised Mastra package.json files depended on easy-day-js at caret 1.11.21, so a fresh npm install resolved to 1.11.22. Aikido noted the same staging pattern as the March Axios campaign, where plain-crypto-js played the equivalent role.

StepSecurity reported that setup.cjs disabled TLS certificate validation, fetched a second-stage script from 23.254.164.92 on port 8000 at path /update/49890878, spawned it as a detached Node process, passed 23.254.164.123:443 as an argument, then deleted itself. Aikido reported the second stage collected system information and targeted more than 160 browser crypto-wallet extensions, with persistence disguised as node-related tooling. StepSecurity's controlled install of @mastra/[email protected] blocked the first-stage fetch before the second stage ran.

Aikido compared Hostwinds VPS infrastructure and the port-8000 first-stage pattern with the Axios dropper. That technical overlap supports CrowdStrike's later grouping of Axios and Mastra under STARDUST CHOLLIMA; it is not independent name-level attribution by Aikido.

Do not add mastra, @mastra/core, npmjs.com, or dayjs as campaign indicators. Those are legitimate packages and registries. The attacker-controlled package published by Aikido and StepSecurity is [email protected].

MITRE ATT&CK Mapping

TechniqueIDContext
Supply Chain Compromise: Compromise Software Dependencies and Development ToolsT1195.001STARDUST CHOLLIMA injected a malicious npm dependency into Mastra framework packages; Aikido and StepSecurity identified that dependency as easy-day-js.
Command and Scripting Interpreter: JavaScriptT1059.007[email protected] ran obfuscated setup.cjs through an npm postinstall hook.
Ingress Tool TransferT1105setup.cjs fetched a second-stage payload from 23.254.164.92:8000.
Application Layer Protocol: Web ProtocolsT1071.001First-stage HTTP fetch on port 8000; second-stage callback to 23.254.164.123:443.
Indicator Removal: File DeletionT1070.004The dropper deleted setup.cjs after execution.
Valid AccountsT1078CrowdStrike reported stolen maintainer credentials for the March Axios compromise; StepSecurity reported compromised @mastra organization credentials for the June republish.

IOCs

Domains

No domain IOCs published by source

Full URL Paths

No URL IOCs published by source

Aikido and StepSecurity published the first-stage fetch as an IP and port, not a domain. Those addresses are in Detection Recommendations and in data/iocs.json as IP indicators. They are not url_path values.

Splunk Format

"easy-day-js" OR "23.254.164.92" OR "23.254.164.123"

File Hashes

No hash IOCs published by source

Package Indicators

npm:[email protected]

[email protected] is the clean bait version. It is not listed as a malware package. Aikido listed 141 compromised Mastra versions from 2026-06-17, including [email protected] and @mastra/[email protected]. Those are temporarily poisoned releases of a legitimate framework, not a malware family name. Hunt lockfiles for easy-day-js rather than denylisting mastra.

Detection Recommendations

Query npm lockfiles, node_modules, and package-lock.json for easy-day-js. Alert on any resolution of [email protected]. Treat a caret pin of easy-day-js@^1.11.21 as the same risk because npm will pull 1.11.22.

On DNS, proxy, and EDR network telemetry, alert on 23.254.164.92 port 8000 and 23.254.164.123 port 443. Hunt Node processes spawned from tmp with a 24-hex filename plus those destinations. Hunt temp files named .pkg_history and .pkg_logs written at install time.

In CI, fail builds that add a new production dependency named easy-day-js, or that republish @mastra packages with an unexpected dependency diff. Review npm publish events for the @mastra org around 2026-06-17 01:12 to 02:39 UTC.

Do not block npmjs.com, mastra.ai, or current Mastra package names as campaign IOCs.

References