North Korea does not just hack crypto exchanges. The CrowdStrike 2026 Threat Hunting Report, published August 3, documents something that should recalibrate how AI development teams think about their supply chain risk: a DPRK-nexus adversary took over a maintainer account for the Mastra AI framework and poisoned 131 npm packages with a combined weekly download count of approximately 8 million.
What happened
In June 2026, DPRK-nexus adversary STARDUST CHOLLIMA (tracked by various vendors as APT38, BlueNoroff, and TA444) compromised the ehindero maintainer account and republished more than 140 packages in Mastra's npm scope. The attack injected a malicious typosquat dependency called easy-day-js into 131 packages across the @mastra and related scopes.
Mastra is an open-source TypeScript framework for building AI agents, RAG pipelines, and multi-model workflows. It is widely used in production AI applications and internal tooling at organizations building on top of frontier models. The approximately 8 million weekly downloads affected represent a very wide blast radius.
The payload had three functions. First, it disabled TLS certificate verification in affected environments, enabling man-in-the-middle interception of HTTPS traffic. Second, it established contact with attacker-controlled C2 infrastructure. Third, it searched for and exfiltrated cryptocurrency wallet files and browser credential stores. The TLS disabling is particularly significant: it means any network traffic from an affected environment, including API calls to LLM providers, could have been intercepted after compromise.
Why AI frameworks are now high-value targets
STARDUST CHOLLIMA's traditional focus has been cryptocurrency theft, and the payload here is consistent with that objective. But the targeting choice is new. By poisoning an AI development framework rather than a general-purpose library, the adversary maximized the probability of landing in environments that handle sensitive API keys, model outputs, and production data.
AI frameworks occupy a privileged position in modern development stacks. They have elevated access to credentials (LLM API keys, database connections), handle sensitive prompts and model outputs, and are often run with broad filesystem and network access during development. A compromised AI framework dependency has approximately the same access profile as a compromised CI/CD system, but with a much larger attack surface because AI frameworks are imported directly into application code.
CrowdStrike also documents that in a separate campaign, one adversary sent nearly 200,000 model API requests in two minutes, apparently attempting to brute-force guardrail configurations. AI frameworks and their API credential stores are the target for that class of attack as well.
The precedent this sets
The ChainDrop incident from last week targeted a general-purpose developer tooling package. The Mastra poisoning targets the AI-specific layer. Together, these incidents establish that AI development infrastructure is now a first-class supply chain attack target, not an afterthought.
The implication for any organization building on open-source AI frameworks is that standard supply chain hygiene now applies to your AI dependencies with the same urgency it applies to authentication or cryptography libraries. Lock dependency versions, verify checksums, audit npm scopes for unexpected changes, and treat AI framework updates as high-privilege events.
What to do
If you use any @mastra scoped packages, check your lock file against the compromise window of mid-June 2026. The specific malicious dependency was easy-day-js; check whether it appears anywhere in your node_modules or package-lock.json. If you installed Mastra packages between approximately June 10 and June 24 without pinned versions, treat the environment as potentially compromised and audit for TLS disabling, unexpected network connections, and credential access.
For broader supply chain hygiene: enable npm package provenance verification where supported, use Sigstore signatures for packages that publish them, and subscribe to security advisories from your major AI framework dependencies directly rather than relying on npm audit alone.
Gigia Tsiklauri is a cybersecurity analyst and the founder of infosec.ge. Reach out to discuss threat intelligence or collaboration.