23[.]254[.]164[.]92

Posts referencing this indicator

• From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet

  Microsoft

  Primary C2 server and payload download endpoint

  2026-06-20
• 140+ Mastra npm Packages Compromised in Coordinated Supply Chain Attack

  Socket

  Stage 1 C2 IP address.

  2026-06-17