DPRK's STARDUST CHOLLIMA targets AI developers: what the Mastra npm supply chain attack means
North Korea's STARDUST CHOLLIMA cluster, tracked by CrowdStrike, poisoned 131 Mastra AI framework packages on npm via stolen package maintainer credentials. Developers who ran npm install with the affected Mastra versions during the exposure window executed malicious code on their machines at installation time, before any additional payload step was required. This is the latest in a sustained DPRK campaign targeting developers in high-value sectors.
How the attack worked
The attackers obtained maintainer credentials for the Mastra npm package, then published poisoned versions tagged as the latest releases. The malicious versions included a dependency called easy-day-js, which executed during the npm install process. Execution at install time is significant: the malware ran before developers had any opportunity to review or sandbox the code.
Developer machines that installed the poisoned versions were exposed to credential theft and remote code execution. The attack was documented in CrowdStrike's 2026 Threat Hunting Report, released August 3. The npm registry has since removed the malicious versions. However, any developer environment that installed Mastra during the exposure window may retain the effects of the initial compromise.
Why AI framework supply chains are a target
Mastra is an AI agent framework. Developers who use it are building AI-powered applications. Those environments typically contain API keys for LLM providers, cloud infrastructure credentials, database connection strings, and access tokens for third-party services. A single successful install-time compromise on a developer workstation can expose the entire credential set an AI application relies on.
STARDUST CHOLLIMA has a documented history of targeting developers in the cryptocurrency and AI sectors. The pattern is consistent: obtain maintainer credentials for a trusted package, publish a poisoned version, collect credentials and access from developers who install it. The Mastra attack follows this playbook exactly, applied to AI infrastructure rather than crypto tooling.
What you should do
If your organization uses Mastra in any development environment, check your package installation history for the affected version range. If a poisoned version was installed, treat the affected machine as compromised. Rotate all credentials that existed in that environment: API keys, cloud tokens, database credentials, LLM provider keys, and any secrets stored in environment variables or configuration files.
At the process level, npm package installs in AI development environments should receive the same scrutiny as any external code execution. Audit your lockfiles, pin dependency versions, and review what executes at install time via the scripts field in package.json. For high-sensitivity environments, consider running npm install in a sandboxed environment before promoting dependencies to production development machines.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you are reviewing supply chain risk in your AI development stack.