Mastra NPM - Marker Drop Followed by C2 Connection

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•4

This rule detects the creation of a '.pkg_history' file, which is a known indicator of the Mastra NPM supply chain compromise, followed by a network connection to specific command and control (C2) IP addresses (23.254.164.123 or 23.254.164.92) within a 5-minute window on the same device. This correlation aims to identify successful exploitation and subsequent C2 communication by the Mastra NPM malware.