Red Team Scenarios is a post-mortem series. Real incidents, defensive framing. This briefing describes a failure class and its mitigation owners, not a replication path.
Domain: Software Supply Chain / Registry Governance / DIB Assurance
Situation Briefing
At 01:01 UTC on June 17, 2026, an npm maintainer account belonging to a former Mastra contributor named ehindero published a new version of a package called easy-day-js. Forty-five minutes later, 144 packages in the @mastra scope carried that same dependency. By 02:00 UTC the payload was live in AI-agent codebases whose combined install volume runs to roughly eight million per week.
The account was not stolen from an active engineer. It belonged to a contributor who had left the project long enough that no one on the current team could name which humans still held publish rights across the scope. Microsoft's threat intelligence group attributed the operation to Sapphire Sleet, a financially motivated North Korean group also tracked as BlueNoroff and Copernicium. The immediate goal was cryptocurrency theft from developer machines. The strategic effect is that the AI-agent framework layer now inherits Pyongyang's currency-generation problem, which is documented in Treasury and UN Panel of Experts reporting as an input to the DPRK missile program.
The disclosure landed on the same week CISA's Binding Operational Directive 26-04 came into force, issued June 10 under Executive Order 14409. The directive gives federal agencies a compressed clock to inventory and remediate AI-adjacent software. It does not have a retroactive purge requirement for packages installed before disclosure. That gap is where this week's decisions have to be made.
The Mechanism
The failure class is not typosquatting and not npm authentication. Both were exercised inside their nominal design. easy-day-js was a typosquat of dayjs, a common date library. The maintainer account had valid credentials and multi-factor authentication. The payload used a postinstall hook, which is a documented and permitted npm behavior.
The failure class is registry governance at the boundary between a dormant contributor account and an automated installer. Three assumptions collapse in the same window:
- That publish rights represent an active human decision. In practice, publish rights outlive a contributor's involvement by years. The Mastra team could not have known which orphaned accounts were still authorized because npm's governance model does not require a re-attestation of publish rights when a contributor stops working on a project.
- That a human review layer exists between a package version and its installation. AI coding agents, package managers running in CI, and dependency-resolution bots install packages before an engineer has read the changelog. The eight-million-weekly-download number is not a measure of human decisions. It is a measure of automation.
- That signature and integrity checks verify provenance. They verify that a signed artifact matches its signer's private key. They do not verify whether the human behind the key is still the human you meant to trust.
Sapphire Sleet did not build a new capability. It found a chair that was already empty and sat down. The tradecraft that matters for the defender is the interval between when a contributor stops caring about a project and when their credentials stop being able to reach production. In npm's current model, that interval is indefinite.
Decision Pressure
The audience for this briefing has decisions to make this week that were not on the calendar June 16.
CISOs and engineering leads. If your organization runs AI coding agents inside developer environments, you need a written policy on what registries those agents may pull from and under what constraints. BOD 26-04 asks for an inventory. If the honest answer to "what installed this package" is "an agent, at 3 a.m., no ticket," the inventory is going to reflect that. The policy has to name a rule for auto-install behavior, not defer the question.
DIB program offices. Prime contractors flow BOD 26-04 down through subcontracts to developer teams. Your bid package's SBOM has to account for AI-agent-installed dependencies, and the assurance language you inherited from CMMC 2.0 does not currently have a control for dormant-maintainer-account exposure. This week's move is to add an interim clause to the developer statement of work and let the FAR council catch up later. The next audit will not.
Federal procurement leads. The Trump AI executive order from June 2, EO 14409, directed CISA, OMB, and the National Cyber Director to prioritize AI-enabled cyber defense at the civilian federal boundary. The order is deliberately silent on what happens when an AI defensive tool is itself downstream of a compromised registry package. That silence lands on procurement. The move this week is to require attestation-backed installation, which is a control that already exists in sigstore and npm's provenance flag but is not yet required in most federal contracts.
Congressional staff. Hearings scheduled for July on North Korean revenue generation and its connection to missile-program financing are going to include the Mastra event. Staffers who want to arrive with a sharpened question rather than a headline need to understand the difference between the registry-governance failure and the identity-based agent compromises that surfaced the preceding week. Both matter. They do not have the same mitigation owner and they cannot be legislated with the same instrument.
Complicating Factors
Financial motivation reads as smaller than state motivation. It is not. The DPRK's cryptocurrency operations are a documented line item in its missile-program funding stream. Treasury sanctioned Lazarus Group and its affiliates on this basis in 2019, and the pattern has held. A supply chain compromise that steals wallets from Western developers subsidizes the launch program on the other side of the Yellow Sea. The failure class is national security in second-order form. Congressional briefings on this event that frame it as "just crypto crime" invite the response Pyongyang wants.
The eight-million-weekly-downloads number is a floor. Mastra is one of hundreds of AI-agent frameworks in active use. The same governance pattern exists at PyPI, at the VS Code Marketplace, at Hugging Face's model registry, and inside Docker Hub image layers. Every registry that supports orphan maintainer credentials is a candidate for the same failure. The Aikido disclosure two weeks earlier of JetBrains marketplace plugins exfiltrating AI API keys is the same class of event with a different registry.
BOD 26-04's 30-day patch clock does not cover packages already installed before disclosure. Federal patch cadence has always been forward-looking. In a world where AI coding agents auto-install packages ahead of human review, retrospective purges become a required control, and no one in the acquisition regulations has written the requirement. That is a policy job for the next quarter, not an engineering job for this week.
Attribution is high-confidence but not unanimous. Microsoft's read is Sapphire Sleet. Some analysts see overlap with Copernicium's dropper pattern. The confidence gap does not change the doctrine question. It changes the political framing. Careful briefings will hold the attribution language precisely and note that the mitigation is the same regardless of which DPRK subgroup owned the operation.
Anna's Read
The mitigation owner is not the framework maintainer. Mastra's team did what a competent open-source team can do inside the constraints they inherited from npm. The mitigation owner is procurement, and specifically the office that writes the language a federal contract flows down through the prime to the developer.
Three moves are actionable this week.
First, procurement language on any AI-touching contract has to require attestation-backed installation. Sigstore, npm's provenance flag, and equivalent PyPI attestations are all inputs to this control. They do not solve the ghost-with-publish-rights problem outright. They raise the cost by attaching a build-system attestation to every published version, which means a compromised dormant account has to also compromise the build system it did not have credentials to reach. A signed package with no attestation should be treated as untrusted in any federal-adjacent codebase.
Second, engineering leads have to publish an internal policy on what AI coding agents may install without human approval. The correct answer is not zero. It is a specific list of registries, an explicit allowlist for scopes, and a set of transitive-dependency rules that constrain what the agent may pull in. The wrong answer is silence, which is what most organizations have today. A policy that says nothing is a policy that says yes.
Third, CISOs and program offices have to run a dormant-maintainer audit against every registry their organization depends on. The Mastra pattern is repeatable. There is no reason to wait for the next disclosure to find out which of your critical dependencies have their publish rights held by an account that has not authored a commit in eighteen months. GitHub's contributor graphs, npm's maintainer listings, and PyPI's role tables are all queryable. The audit is unglamorous and it will find things.
The strategic read is that the AI-agent framework layer is now a first-class supply chain surface. It is not a curiosity for developer-relations teams. It is a supply chain that touches DIB code, federal civilian systems, and financial-services codebases in overlapping ways, and it is going to be worked by both financially motivated DPRK operators and the state services adjacent to them. The doctrine question is who owns the assurance. The honest answer is that today no one does. That is the situation the CISO, the program office, and the congressional staffer inherit this week. Name it clearly, write it into the next control review, and stop treating registry governance as an infrastructure problem that lives one org chart away from procurement.
Related Briefings
Anna R. Dudley writes on national security, AI policy, and the institutional structures absorbing the costs of AI deployment faster than they are being redesigned. Red Team Scenarios is the series for the call you don't want to take. Subscribe at annardudley.substack.com.