NPM attack targets Zapier and security tool browser extensions
Malicious NPM packages disguised as Mastra tooling were found targeting browser extensions for Zapier and security tools. The attack exfiltrates credentials and sensitive session data via compromised npm dependencies.
Background
- Mastra is an open-source AI agent framework (TypeScript/Node.js) from a Y Combinator–backed startup. It is unrelated to this incident except as a target of supply-chain attacks.
- NPM (Node Package Manager) is the default package registry for JavaScript/Node.js projects. Malicious actors routinely publish typosquatted or lookalike packages that contain malware; this is called a "supply-chain attack."
- Zapier is a widely used automation platform that connects different web apps (e.g., Gmail + Slack) via triggers and actions. Its browser extension is a high-value target for credential theft.
- This attack planted lookalike NPM packages (typosquatting legitimate ones) that, when installed by developers, would steal browser‑extension credentials — specifically targeting Zapier and multiple security‑tool extensions — and exfiltrate them to a remote server.
- The threat is that developers who accidentally install the malicious package compromise not only their own machine but also any connected business accounts (Zapier, password managers, VPNs, etc.).