The North Korean state-sponsored threat actor Sapphire Sleet is behind the Mastra supply chain attack that hit over 140 NPM packages last week, Microsoft reports. Mastra is an open source TypeScript framework for building AI agents, workflows, and RAG pipelines. It offers integrations for major LLM providers, MCP servers, and cloud deployments. The supply chain attack occurred on June 17. During a 45-minute window, the hackers published 141 packages that contained the malicious dependency easy-day-js, a typosquat of the legitimate dayjs date library. The affected Mastra packages have approximately 8 million weekly downloads. All users who installed a @mastra package during the attack window on June 17 should consider their systems affected. As part of the attack, the hackers compromised…