easy-day-js C2 Spoofed IE8 User-Agent

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•0•0•7

This rule detects command and control (C2) communication associated with the 'easy-day-js' backdoor, which is part of the Mastra npm supply chain attack. It specifically looks for HTTP POST requests to the IP address 23.254.164.123 with a spoofed Internet Explorer 8 User-Agent string.