From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet

In this article Attack chain overview Discovery and initial indicators Dependency injection: the poisoned package.json Typosquat analysis: easy-day-js Staged delivery pattern Obfuscation and payload analysis TLS bypass to self-deletion Timeline analysis Who is Sapphire Sleet? Mitigation and protection guidance Microsoft Defender XDR detections Microsoft Security Copilot Advanced hunting Indicators of compromise (IOC) References Learn more June 19, 2026 update: Microsoft assesses with high confid