Security · 1h ago
North Korean Hackers Compromise 140+ npm Packages Targeting AI Developers
On June 17, 2026, Microsoft attributed a supply chain attack on over 140 @mastra npm packages to North Korean state actor Sapphire Sleet. The malicious postinstall scripts exfiltrated AI API keys, cloud credentials, and CI/CD tokens from developer machines within seconds. Affected developers who ran npm install between June 14-17 must rotate all credentials immediately.
Meridian48 take
This attack signals a strategic shift: nation-states now view AI developer tooling as the highest-value credential target, far beyond traditional corporate workstations.
Read the full reporting
Nation-State Actors Are Now Targeting Your AI Agent's npm Packages →
DEV Community
supply-chain-attacknpm