Mastra NPM - IP Arg Exec to .pkg_logs Drop

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•2

This rule detects the execution of Node.js processes that include specific attacker IP addresses (23.254.164.123:443 or 23.254.164.92:8000) in their command line arguments, combined with the creation of a file named '.pkg_logs'. This behavior is indicative of the Mastra NPM supply chain attack, where malicious packages drop a logging file after execution.