Executive Summary

Last week’s reporting centered on developer access as a route into software supply chains and cryptocurrency systems. The Mastra incident put that risk into production at scale: a compromised maintainer account added easy-day-js to more than 140 npm packages, exposing developer workstations and CI runners to a cross-platform Node.js implant. Other reports described malicious code hidden in configuration files, blockchain-based payload resolution, fake interviews, and poisoned packages.

The same access problem appeared in cryptocurrency custody. Reporting on Humanity Protocol and Bybit traced major losses to compromised workstations, exposed signing material, cloud sessions, and manipulated interfaces rather than broken cryptography. DPRK IT worker investigations showed a parallel path into companies through stolen identities, laptop farms, and fraudulent hiring.

Key Trends

1. One maintainer account exposed the Mastra release chain

Microsoft attributed the Mastra compromise to Sapphire Sleet with high confidence. The actor took over the dormant ehindero npm account and inserted easy-day-js into more than 140 mastra and @mastra packages. Mastra said the takeover followed social phishing through a compromised LinkedIn account.¹²

The malicious dependency ran during installation, disabled TLS validation, downloaded a second Node.js stage, detached it from the install process, and removed the dropper. Researchers documented Windows, macOS, and Linux persistence, browser and wallet reconnaissance, remote tasking, and possible exposure of developer and CI credentials.³⁴⁵⁶ OpenSourceMalware found close overlap with the Axios npm compromise but kept attribution unconfirmed, as did TuxCare and Snyk.⁷⁸⁹

2. Developer files, packages, and interviews all became execution paths

A developer found obfuscated JavaScript in tailwind.config.js and another backend file across several repositories. The code reportedly used TRON JSON-RPC with an Aptos fallback to resolve later infrastructure. The author linked the activity to Void Dokkaebi, while noting that initial access was still unknown.¹⁰ Checkmarx described similar blockchain-backed resolution in ChainVeil, a campaign attributed to an actor it calls SuccessKey. Its npm loaders used TRON, Aptos, and Binance Smart Chain transactions before delivering a remote-access trojan.¹¹

AhnLab’s monthly reports placed these techniques in a wider DPRK-linked pattern involving malicious Git hooks, Jenkins workflows, npm and Packagist branches, Cloudflare Workers, and blockchain RPC services.¹²¹³ ESRC tied the chai-as-init npm package to Contagious Interview after it stole environment variables and executed remote JavaScript from Vercel-hosted infrastructure.¹⁴

Recruitment supplied the social pretext. One LinkedIn lure sent a developer to a GitHub project whose npm prepare script launched a backdoor.¹⁵ A separate discussion of fake interviews described how plausible recruiter contact, broken calls, shared repositories, login prompts, and screen sharing can gradually move a target toward execution or credential disclosure.¹⁶

3. Endpoint access defeated cryptocurrency custody controls

A Humanity Protocol director reportedly opened a spearphishing email impersonating Bithumb. Malware on the director’s Windows laptop exposed MetaMask data and enough production keys to cross multisignature thresholds. The attacker then changed ProxyAdmin ownership, drained bridge assets, and enabled unauthorized token minting.¹⁷¹⁸

Bybit reporting traced the February 2025 theft to a compromised Safe{Wallet} developer workstation, stolen cloud sessions, AWS access, and injected frontend JavaScript that showed signers legitimate transaction details while changing the underlying action. Sygnia said the operation aligned with Lazarus tradecraft.¹⁹ Bybit’s later complaint attributed the theft to Lazarus acting for North Korea’s Reconnaissance General Bureau and said only about $75.5 million of the roughly $1.5 billion theft had been frozen or recovered by the filing date.²⁰ A broader Lazarus overview placed these cases beside fake recruitment, poisoned packages, IT worker infiltration, and laundering through cross-chain services.²¹

4. Document shortcuts kept script-heavy intrusion chains active

AhnLab analyzed LNK files disguised as a consent form and a resume. The consent-form chain opened a decoy while PowerShell created downloaders, scheduled-task persistence, host discovery, and an in-memory backdoor loader.²² The resume lure created batch, PowerShell, and VBScript files, registered recurring execution, downloaded later components with curl, and used DLL side-loading to run Xctdoor.²³

The information-stealing flow resembled earlier Kimsuky activity, but the reports focused on the observed execution chains rather than making a broad new attribution. The practical detection point is the process lineage from an apparent business document into script interpreters, scheduled tasks, and side-loaded DLLs.

5. IT worker operations scaled identity and access fraud

Nisos identified more than 170,000 applications to US companies over ten months, producing 76 offers for 22 operatives. The operation used appropriated identities, forged documents, AI-assisted interviews, US laptop farms, PiKVM devices, Tailscale, VPNs, and cryptocurrency payments.²⁴

Balkan Insight reported stolen identities from Bosnia and Serbia on freelance platforms, along with overseas facilitators and payment services.²⁵ Together, the cases show why hiring controls need to verify the person, device, location, remote access path, and payment owner before repository or cloud access is granted.

What to Watch

Organizations that installed affected Mastra releases should investigate the workstation or runner where installation occurred. Review lifecycle-script execution, outbound Node.js traffic, persistence, browser and wallet access, and exposure of CI secrets. Rotate credentials from a clean system and rebuild affected environments.

Run unfamiliar coding tests in isolated environments without production credentials. Cryptocurrency organizations should separate privileged keys across independently controlled systems, add timelocks to administrative changes, and verify the transaction actually signed rather than relying only on the displayed interface.

Reports Reviewed