Mastra npm Compromise - easy-day-js C2 Network Connection

Lourenço Santos@lourenco

•updated Jun 17, 2026•0•0•5

Detects outbound network connections to the attacker-controlled infrastructure used in the June 2026 Mastra npm supply chain attack (easy-day-js campaign). IP 23.254.164.92 served the second-stage payload; 23.254.164.123 was the C2 exfiltration server for the cross-platform infostealer.