easy-day-js Mastra npm Supply Chain - C2 Exfil

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•1•0•27

This rule detects network activity associated with the easy-day-js Mastra npm supply chain attack. Specifically, it identifies data exfiltration over TLS to a secondary C2 server (23.254.164.123:443) and the download of a stage-2 payload from a primary C2 server (23.254.164.92:8000) via HTTP, looking for the URI '/update/49890878'.