Mastra NPM - Node running from Temp connecting to 23.254.x

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•1

This rule detects instances where 'node.exe' is executed from a temporary directory (e.g., 'temp' or 'tmp') and initiates a network connection to an IP address within the '23.254.164.0/24' subnet. This behavior is indicative of the Mastra NPM supply chain compromise, where malicious node packages drop and execute payloads from temporary locations to establish C2 communication.