• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Mastra NPM - setup.cjs Dropper Execution to Network Exfil

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Ibrahim Saud@tektrix
    •updated Jun 19, 2026•0•0•5

    Correlates the execution of the initial dropper script (setup.cjs) to the hardcoded C2 IPs, indicating potential compromise by the Mastra NPM malware.

    Microsoft Sentinel (KQL)

    Tags

    T1071.001 - Web ProtocolsT1041 - Exfiltration Over C2 ChannelT1195.001 - Compromise Software Dependencies and Development ToolsTA0011 - Command and ControlTA0010 - ExfiltrationTA0001 - Initial AccessProcess EventNetwork ConnectionMalware DetectedData ExfiltrationLinuxWindowsmacOSWindows Defender Atpkql

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?