140+ Mastra npm Packages Compromised in Coordinated Supply Chain Attack

MITRE Techniques

• [T1195.002] Compromise Software Supply Chain – The attacker compromised published npm packages and delivered malware through a transitive dependency (‘malicious npm supply chain campaign involving compromised @mastra/* packages’ and ‘pulled in that dependency, so npm install … runs setup.cjs automatically’).
• [T1059.007] JavaScript – The payloads were implemented as Node.js/JavaScript scripts and executed by npm lifecycle hooks (‘node setup.cjs’ and ‘cross-platform Node.js tasking client’).
• [T1068] Exploitation for Privilege Escalation – Not explicitly mentioned as privilege escalation; not applicable.
• [T1105] Ingress Tool Transfer – The loader downloaded a second-stage payload from attacker-controlled infrastructure (‘fetch(url)’ and ‘pull stage 2’).
• [T1573.001] Encrypted Channel – The loader and implant communicated over HTTPS/TLS to attacker infrastructure (‘fetch the second-stage payload from attacker-controlled infrastructure over TLS’ and ‘sends … over HTTPS POST’).
• [T1041] Exfiltration Over C2 Channel – Collected data was sent back to attacker servers through the implant’s tasking/exfiltration channel (‘Collected data is exfiltrated to the operators’ command-and-control host’).
• [T1053.003] Cron – Not explicitly used; Linux persistence was via systemd user service, not cron.
• [T1547.001] Registry Run Keys / Startup Folder – Windows persistence was established via a Run key (‘Windows Run value NvmProtocal’).
• [T1543.002] Systemd Service – Linux persistence used a systemd user unit (‘nvmconf.service’ and ‘ExecStart=…protocal.cjs’).
• [T1547.013] PowerShell Profile – Not mentioned in the article; not applicable.
• [T1547.007] Launch Agent – macOS persistence used a LaunchAgent (‘macOS LaunchAgent label com.nvm.protocal’).
• [T1027] Obfuscated Files or Information – The loader was obfuscated with obfuscator.io (‘obfuscated with obfuscator.io’).
• [T1112] Modify Registry – The Windows Run key was written for persistence (‘Windows Run value NvmProtocal’).
• [T1562.013] Disable or Modify System Firewall – Not mentioned; no firewall modification described.
• [T1057] Process Discovery – The implant collected running processes (‘installed applications, and running processes’).
• [T1082] System Information Discovery – The implant collected hostname, architecture, platform, and user ID (‘hostname, architecture, platform, user ID’).
• [T1217] Browser Session Cookie – Not directly recovered; the article says browser history was collected, not cookies.
• [T1217 / T1213] Data from Local System – The implant copied browser History databases from Chrome, Edge, and Brave (‘copies each profile’s History database’).
• [T1119] Automated Collection – The implant automatically inventoried wallet extensions and browser history during its tasking loop (‘carries a hardcoded list of 166 wallet browser-extension IDs’ and ‘copies each profile’s History database’).
• [T1021] Remote Services – Not explicitly used for lateral movement; the article does not describe remote service abuse.
• [T1070.004] File Deletion – The loader self-deleted to reduce traces (‘fs.rmSync(__filename, { force: true }); // self-delete’).
• [T1090] Proxy – Not mentioned; no proxy behavior described.
• [T1102] Web Service – The implant used web-based HTTPS endpoints for tasking and exfiltration (‘beacons to the operator’ and ‘over HTTPS POST’).