kyber.today

daily cyber × ai intelligence

← threat actors

threat actor

STARDUST CHOLLIMA

also tracked as sapphire sleet 1

related, not merged: Lazarus Group 18

1 story · 1 in the wild · June 20, 2026 – June 20, 2026

evidence: 1 observed

how they got in

  • package registry 1 · Jun 20
  • supply chain 1 · Jun 20

sectors

  • developers 1 · Jun 20
  • technology 1 · Jun 20

geography

  • north korea 1 · Jun 20

malware and tools

  • infostealer 1 · Jun 20

attack phases seen

  • Execution 1 · Jun 20
  • Initial access 1 · Jun 20

what we reported, newest first, grouped by story

Jun 17 – June 20, 2026

  • 145 Mastra npm packages (@mastra/*, a popular AI-app framework) were trojanized after a contributor account was hijacked, with easy-day-js@1.11.22 dropping a postinstall remote payload. Microsoft attributes the campaign to Sapphire Sleet (North Korea–nexus, lineage to the Axios/APT38 npm activity); Nextron flagged related infostealer packages whose Rust second stage hunts crypto seed phrases, .env/.npmrc/SSH keys, and enumerates SentinelOne, Defender, and Little Snitch on macOS. The Hacker News, Microsoft · Jun 20 · observed · via package registry · as sapphire sleet · Cloud, Identity & Supply Chain