North Korean Hackers Slipped Malware Into 131 npm Packages by Social-Engineering a Mastra AI Employee on LinkedIn

CrowdStrike’s 2026 Threat Hunting Report, published August 3, details how the DPRK-nexus group STARDUST CHOLLIMA injected a malicious npm package as a dependency into at least 131 packages belonging to the Mastra AI framework in June 2026. The entry point wasn’t a technical exploit — it was social engineering. The group approached a Mastra employee on LinkedIn, moved the conversation to a video call, and talked the employee into clicking a malicious link that gave them the access needed to compromise the package’s dependency chain.

This wasn’t STARDUST CHOLLIMA’s first hit on the JavaScript supply chain this year. In March 2026, the same group used stolen maintainer credentials to compromise the widely used Axios npm package, delivering platform-specific variants of their ZshBucket malware to anyone who pulled a poisoned version. Two separate campaigns against two different high-traffic packages inside four months is a pattern, not an isolated incident — and it specifically targets the AI supply chain: Mastra is a TypeScript framework used to build AI agents, meaning a compromise here plants malicious code inside the tooling other companies use to ship their own AI products.

The report frames this inside a bigger shift: AI-enabled adversary activity climbed 89% year-over-year, and during the first half of 2026, 87% of identified software registry threats involved malicious npm packages specifically. STARDUST CHOLLIMA’s Mastra campaign is CrowdStrike’s lead example of what it classifies as an AI Supply Chain Compromise under the MITRE ATLAS framework — attackers going after the packages and dependencies that AI development pipelines rely on, rather than attacking a model or an application directly. Separately, the eCrime actor ALTERED SPIDER compromised more than 300 software dependencies in a single day during the same period, harvesting credentials and pivoting into victims’ cloud environments.

For engineering teams, the actionable takeaways are concrete. First, credential-based social engineering aimed at maintainers is now a primary attack vector for supply chain compromise — treat unsolicited LinkedIn outreach followed by a push to “hop on a call” as a red flag, especially for anyone with publish access to shared packages. Second, run npm audit and pin dependency versions rather than trusting caret ranges, since a compromised transitive dependency can land in a build without a direct version bump in your own package.json. Third, if your stack uses Mastra or Axios, verify you’re on versions published after the disclosed compromise windows and rotate any credentials that touched CI during the affected period.

The broader lesson from CrowdStrike’s report is that AI tooling itself has become a preferred target precisely because it sits upstream of so much downstream software — compromise the framework, and you compromise everything built on it.

Sources

Related reading