CrowdStrike Holdings, Inc. (NASDAQ:CRWD) said on August 3 that a North Korea-linked adversary injected a malicious dependency into at least 131 Mastra AI framework packages on npm (Node Package Manager). Microsoft Corporation (NASDAQ:MSFT) owns GitHub, which acquired npm in 2020 and operates the registry at the center of the attack chain.
This was a developer-supply-chain breach with unusually efficient distribution. Stolen maintainer credentials let the attacker publish poisoned Mastra versions tagged as the latest releases. The malicious easy-day-js dependency then ran during installation, exposing developer machines and build pipelines to credential theft and remote code execution. CrowdStrike found that 87% of identified software-registry threats in the first half of 2026 involved npm packages.
Image by Tawanda Razika from Pixabay
Microsoft's role cuts both ways. GitHub controls the registry infrastructure, and its advisory database powers npm audit, so repeated account takeovers increase the burden to harden publishing and dependency scanning. Yet Microsoft's own June 17 investigation identified more than 140 affected Mastra packages and detailed detections across Defender Antivirus, Defender for Endpoint and Defender XDR. The same incident that creates reputational risk for npm also gives Microsoft another reason to sell integrated security.
The more direct demand read-through belongs to CrowdStrike. Its fiscal Q1 2027 revenue grew 26% to $1.39 billion, while annual recurring revenue rose 24% to $5.51 billion. Hedge-fund ownership also increased to 79 portfolios at the end of Q1 2026 from 67 in Q4 2025, according to Insider Monkey's database. The valuation is the restraint: a roughly $190 billion market value equals about 32 times CrowdStrike's $5.91 billion to $5.96 billion fiscal-year revenue guidance. The business must sustain growth near the mid-20% range for that multiple to remain comfortable.
#NASDAQ
This was a developer-supply-chain breach with unusually efficient distribution. Stolen maintainer credentials let the attacker publish poisoned Mastra versions tagged as the latest releases. The malicious easy-day-js dependency then ran during installation, exposing developer machines and build pipelines to credential theft and remote code execution. CrowdStrike found that 87% of identified software-registry threats in the first half of 2026 involved npm packages.
Image by Tawanda Razika from Pixabay
Microsoft's role cuts both ways. GitHub controls the registry infrastructure, and its advisory database powers npm audit, so repeated account takeovers increase the burden to harden publishing and dependency scanning. Yet Microsoft's own June 17 investigation identified more than 140 affected Mastra packages and detailed detections across Defender Antivirus, Defender for Endpoint and Defender XDR. The same incident that creates reputational risk for npm also gives Microsoft another reason to sell integrated security.
The more direct demand read-through belongs to CrowdStrike. Its fiscal Q1 2027 revenue grew 26% to $1.39 billion, while annual recurring revenue rose 24% to $5.51 billion. Hedge-fund ownership also increased to 79 portfolios at the end of Q1 2026 from 67 in Q4 2025, according to Insider Monkey's database. The valuation is the restraint: a roughly $190 billion market value equals about 32 times CrowdStrike's $5.91 billion to $5.96 billion fiscal-year revenue guidance. The business must sustain growth near the mid-20% range for that multiple to remain comfortable.
#NASDAQ
2 months ago
