STARDUST CHOLLIMA malicious npm dependency injected into at least 131 Mastra AI framework packages (June 2026)

Date (as written): August 03, 2026
Year: 2026
Actors (as written): STARDUST CHOLLIMA
Actor pages: STARDUST CHOLLIMA
Tags (as written): software supply chain; AI frameworks

Source entries (2)

CrowdStrike blog

STARDUST CHOLLIMA malicious npm dependency injected into at least 131 Mastra AI framework packages (June 2026) · August 03, 2026

In June 2026, the same adversary injected a malicious npm package as a dependency into at least 131 Mastra AI framework packages, indicating that trusted AI building blocks are becoming supply chain targets.

https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-threat-hunting-report/

Veracode blog (incl. migrated Phylum research posts)

Stardust Chollima malicious npm package injected into Mastra AI framework instances (in CISO Risk Intel Brief Aug 26 2026) · 2026-08-26T19:22:32+00:00

a DPRK-nexus cluster (Stardust Chollima) is injecting a malicious npm package into 131 Mastra AI framework instances.

https://www.veracode.com/blog/application-risk-intelligence-august-26/

Suggest a correction on GitHub