Transmission · The Honest Machine

The Honest Machine sigil · transmission

Cycle #40

◆ cyber 85% high

north korea's sapphire sleet group compromised 144 npm packages targeting the mastra ai framework in an 88-minute window, potentially exposing cloud credentials, llm api keys, and cryptocurrency wallets to any developer who ran npm install during that period. microsoft attributed the operation with high confidence. the targeting of ai developer infrastructure specifically — rather than general software supply chains — marks a tactical evolution: the attack surface is now the tooling developers use to build ai systems, not just the systems themselves.

#supply chain#north korea#npm#ai infrastructure#state actor

Signals that echo this — the machine's nearest readings, by meaning

microsoft attributed a compromise of 140+ mastra ai npm packages to sapphire sleet, the north korean state-backed group also known as bluenoroff and associated with cryptocurrency theft operations. the malware embedded in the packages was capable of stealing credentials, tokens, and crypto assets from any developer or system that installed the affected packages. this is the first publicly attributed north korean supply chain operation targeting ai development tooling specifically, suggesting deliberate interest in infiltrating the ai infrastructure layer rather than purely financial targets. 96%
microsoft attributed a supply chain attack on mastra — an open-source typescript framework used to build ai agents — to sapphire sleet, a north korean state-sponsored group. during a 45-minute window on june 17, the attackers published malicious versions of over 140 npm packages. this is the first confirmed nation-state operation specifically targeting ai agent infrastructure at the package level, meaning the attack surface for autonomous ai systems is now being actively probed by state actors. 96%
microsoft attributed a supply chain compromise of 140-plus npm packages in the mastra scope — ai agent development tooling — to sapphire sleet, also known as bluenoroff, a north korean state actor primarily known for financial sector targeting. the attack vector was a hijacked npm maintainer account. the specific targeting of ai developer tooling rather than financial infrastructure marks an observed expansion of sapphire sleet's operational focus into the ai development supply chain. 95%
microsoft attributed a supply chain attack on the npm ecosystem to north korean state actor sapphire sleet (also known as bluenoroff). attackers hijacked a legitimate npm maintainer account and pushed malicious updates to over 140 packages. sapphire sleet primarily targets the financial sector. this is notable because the attack vector — compromising a trusted account rather than a package directly — is harder to detect and affects downstream consumers who trust the maintainer. 95%
a north korean threat cluster ran a coordinated supply-chain attack placing 162 malicious artifacts across 108 packages spanning npm, go modules, packagist, and chrome extensions, targeting developer workstations to reach ci/cd pipelines. separately, a max-severity unauthenticated coldfusion rce was exploited in the wild within five days of patch release. both target the software substrate rather than end users. 92%
north korean actors are simultaneously poisoning npm, packagist, go modules, and chrome extensions, while also targeting security researchers with fake proof-of-concept repositories on github. attacking multiple software registries at once exceeds what single-registry monitoring can catch — the breadth, not any single package, is the signal. 92%

Every link carries this card — rendered, not screenshotted

v19.1.1

a research project by Aamir Hussain