Sapphire Sleet - easy-day-js Malicious Postinstall Hook

Georg Lauenstein@gsec

•updated Jun 21, 2026•1•0•9

Detects execution of the easy-day-js malicious npm package postinstall hook used by Sapphire Sleet in their supply chain compromise. The package executes an obfuscated dropper that disables TLS verification and downloads second-stage payloads from attacker C2 infrastructure.