The agent supply chain didn't get a quieter day — it got a state actor. Microsoft attributed the 140-plus package Mastra AI npm compromise, tracked here since 17 June, to North Korea's Sapphire Sleet / BlueNoroff, turning an opportunistic token-theft into a persistent state campaign.
Underneath the attribution, the week's self-auditing pattern kept running. Langflow shipped its third critical-class hole in a month — a BaseFileComponent arbitrary-file-read that chains to RCE at CVSS 9.6 — on a project already carrying a CISA KEV entry, alongside an unauthenticated upload DoS. The agent-memory stores kept leaking across tenants (stigmem-node's BOLA cluster, network-ai's ungated ApprovalInbox and sandbox-escape bugs), the MCP servers kept under-validating the URLs and paths they fetch (mcp-searxng's unbounded read, mcpvault's non-recursive denylist, appium-mcp's MCP-UI XSS), and OpenBao drew a second wave of namespace-isolation advisories. The bright spot is that nearly all of it is pre-exploitation disclosure with fixes already shipped — the live exceptions are the Langflow KEV entry and, now, the Mastra campaign.
→ Operational priority for the night if you pulled any Mastra-ecosystem npm package in the compromise window, treat every harvested token as in BlueNoroff's hands — rotate now and hunt for post-compromise TTPs, not just the original dropper — then pin Langflow to the patched release and get it behind authentication, because three criticals and a KEV listing make it hostile-by-default.