North Korean Hackers Poisoned 140+ npm Packages in an AI Dev Tooling Attack. Here's What Would Have Caught It. (opens in new tab)

The Incident Microsoft's threat intelligence team has attributed a supply chain attack targeting the Mastra AI ecosystem to Sapphire Sleet (also tracked as BlueNoroff), a North Korean state-sponsored hacking group. The attackers compromised over 140 npm packages — not obscure, one-download throwaway packages, but packages embedded in the Mastra AI dependency graph that developers and AI coding tools actively pull. The attack vector that makes this particularly sharp: AI-powered coding assista...