`221c45a790dec2a296af57969e1165a16f8f49733aeab64c0bbd768d9943badf`

221c45a790dec2a296af57969e1165a16f8f49733aeab64c0bbd768d9943badf is a file hash that 3 published sources report in connection with APT38 activity, which public reporting attributes to North Korea (DPRK). It is cited here from SafeDep, Snyk and Microsoft. The earliest of those reports is dated 2026-06-16 and the most recent 2026-06-18.

file hash APT38 MATCHED IN SOURCE

Listed as 221c45a790de...

First seen 2026-06-16 · last seen 2026-06-18

Sources

…, ~/.config/NodePackages Windows: C:\ProgramData\NodePackages Hashes (SHA256) Stage-2 payload: 221c45a790dec2a296af57969e1165a16f8f49733aeab64c0bbd768d9943badf easy-day-js@1.11.21 tarball: 4a8860240e4231c3a74c81949be655a28e096a7d72f38fbe84e5b37636b98417 easy-day-js@1.11.22 tarball:…
Mastra npm Scope Takeover: 143 Packages Drop a RAT - Real-time Open Source Software Supply Chain Security — SafeDep · under “Indicators of Compromise” · published 2026-06-17 · pulled 2026-10-01
…output. Deletes itself to reduce forensic traces. The payload: a multi-platform crypto stealer and RAT The second stage (SHA256 221c45a790dec2a296af57969e1165a16f8f49733aeab64c0bbd768d9943badf ) is an obfuscated cryptocurrency wallet stealer , the same payload class Snyk has tracked in earlier npm compromises.…
Mastra npm Scope Takeover | Snyk — Snyk · under “The payload: a multi-platform crypto stealer and RAT” · published 2026-06-16 · pulled 2026-09-11
…bait tarball) B73DE25C053C3225A077738A1FCBD9CA6966D7B3CD6F5494A30F0AA0EAE55C7E SHA-256 mastra-1.13.1.tgz (compromised CLI tarball) 221c45a790dec2a296af57969e1165a16f8f49733aeab64c0bbd768d9943badf SHA-256 protocol.cjs 50eae63d3e24be9ca8803f4b5a0408aef97ee3fab7af018d8c2dde7c359edd65 SHA-256 Downloader and backdoor PowerShell script…
From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet | Microsoft Security Blog — Microsoft · under “Indicators of compromise (IOC)” · published 2026-06-18 · pulled 2026-09-11

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: Mastra npm Scope Takeover: 143 Packages Drop a RAT - Real-time Open Source Software Supply Chain Security

SafeDep lists 6 other indicators in this source. 5 are shown, chosen across types.

All 7 indicators from this source

Cited by the same report: From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet | Microsoft Security Blog

Microsoft lists 11 other indicators in this source. 7 are shown, chosen across types.

All 12 indicators from this source