Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
15 IOCs
From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet
Threat Actors
Malware Families
Excerpt
In this article Attack chain overview Discovery and initial indicators Dependency injection: the poisoned package.json Typosquat analysis: easy-day-js Staged delivery pattern Obfuscation and payload analysis TLS bypass to self-deletion Timeline analysis Who is Sapphire Sleet? Mitigation and protection guidance Microsoft Defender XDR detections Microsoft Security Copilot Advanced hunting Indicators of compromise (IOC) References Learn more June 19, 2026 update: Microsoft…
Read the original report →Diamond Model
Adversary(2)
Infrastructure(5)
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →15 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | ae70dd4f6bc0d1c8c2848e4e6b51934626c4818dcb5af99d080ddbd7dc337185 | Medium | Score 38/100 | First seen |
| SHA256 | 4a8860240e4231c3a74c81949be655a28e096a7d72f38fbe84e5b37636b98417 | Medium | Score 45/100 | First seen |
| sergey2016@tutamail.com | High | Score 58/100 | First seen | |
| SHA256 | 50eae63d3e24be9ca8803f4b5a0408aef97ee3fab7af018d8c2dde7c359edd65 | Medium | Score 53/100 | First seen |
| IP | 23.254.164.92 | High | Score 79/100 | First seen |
| MD5 | 09442294c21d601512eb3587c3076172 | Medium | Score 53/100 | First seen |
| ehindero2016@tutamail.com | High | Score 58/100 | First seen | |
| SHA256 | b122a9873bedf145ae2a7fd024b5f309007dbb025149f4dc4ac3f7e4f32a36a4 | Medium | Score 46/100 | First seen |
| IP | 23.254.164.123 | High | Score 72/100 | First seen |
| URL | https://teams.onweblive.org/api/update/8555575039/4 | High | Score 58/100 | First seen |
| SHA256 | 1d1bf5e8c1539d2f05b1429235b8f4990f87036774be95157b315a7803dd5526 | Medium | Score 53/100 | First seen |
| URL | https://23.254.164.92:8000/update/49890878 | Medium | Score 49/100 | First seen |
| SHA256 | b73de25c053c3225a077738a1fcbd9ca6966d7b3cd6f5494a30f0aa0eae55c7e | Medium | Score 45/100 | First seen |
| SHA256 | 221c45a790dec2a296af57969e1165a16f8f49733aeab64c0bbd768d9943badf | Medium | Score 46/100 | First seen |
| URL | https://maskasd.com/8555575039 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…