hxxps://23[.]254[.]164[.]92:8000/update/49890878

Posts referencing this indicator

• From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet

  Microsoft

  Payload download endpoint for second-stage implant

  2026-06-20
• 140+ Mastra npm Packages Compromised in Coordinated Supply Chain Attack

  Socket

  Stage 1 C2 server and Stage 2 payload download URL.

  2026-06-17