{
    "type": "bundle",
    "id": "bundle--6f23af65-58a4-40e1-8aaf-500424440f6f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--a361b290-d09a-4e0e-a13d-681ca0c3dcc7",
            "created": "2023-03-08T12:51:43.404685Z",
            "modified": "2024-08-31T04:09:59.408166Z",
            "name": "Microsoft",
            "identity_class": "organization"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--1c557bdf-379a-44dc-a0e1-d5ded122fb4e",
            "hashes": {
                "SHA-256": "4a8860240e4231c3a74c81949be655a28e096a7d72f38fbe84e5b37636b98417"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--43d934c8-1650-4b14-aa97-45a88a0cde4e",
            "hashes": {
                "MD5": "c18fd75526533dfc90e91e2fb80effaf",
                "SHA-1": "cd1129d1522a553d0365c433657cee39e4fae82d",
                "SHA-256": "221c45a790dec2a296af57969e1165a16f8f49733aeab64c0bbd768d9943badf"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--ba013c36-9b6e-4b21-bd99-3c5f684f5845",
            "value": "https://23.254.164.92:8000/update/49890878"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--b65a715f-2d52-4218-a4c2-c9cbadde923a",
            "value": "23.254.164.123"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--8a8d00b1-00b9-4f71-ab55-b7bf3734edcf",
            "value": "23.254.164.92"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--fe5ba5d9-3600-46c4-baf6-212a667923e6",
            "hashes": {
                "SHA-256": "1d1bf5e8c1539d2f05b1429235b8f4990f87036774be95157b315a7803dd5526"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--58c0280d-cac6-4a46-bd62-b776e8d1f294",
            "hashes": {
                "MD5": "465a6e816b9e140e3c7cdfb2a4464d6f",
                "SHA-1": "542c9c7536b8f9f7b6aff9583274277af685fc82",
                "SHA-256": "50eae63d3e24be9ca8803f4b5a0408aef97ee3fab7af018d8c2dde7c359edd65"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--743d6624-8ca7-489e-8b22-e88d1634ee27",
            "hashes": {
                "SHA-256": "b73de25c053c3225a077738a1fcbd9ca6966d7b3cd6f5494a30f0aa0eae55c7e"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--b8f8c564-78c3-40b3-a716-1a07669617cb",
            "hashes": {
                "MD5": "b13415f8c734e0d45aeca083ffcfe153",
                "SHA-1": "4727365754cc41e4ba5a483f328289fd09a54651",
                "SHA-256": "ae70dd4f6bc0d1c8c2848e4e6b51934626c4818dcb5af99d080ddbd7dc337185"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--be59e800-62da-4b1d-b9ab-3df91626cba8",
            "hashes": {
                "MD5": "f29630beb594dbf25e738165705bb4a5",
                "SHA-1": "52baf9cedd288b0d53a5caed3e103487d9412ab9",
                "SHA-256": "b122a9873bedf145ae2a7fd024b5f309007dbb025149f4dc4ac3f7e4f32a36a4"
            }
        },
        {
            "type": "email-addr",
            "spec_version": "2.1",
            "id": "email-addr--59981efc-dfde-4a77-8559-acc8a874404f",
            "value": "sergey2016@tutamail.com"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--871fc01c-c5c5-44b1-86cb-2a69a259507c",
            "value": "https://maskasd.com/8555575039"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--e8628e82-162c-4958-a296-94a0de4ebea9",
            "value": "https://teams.onweblive.org/api/update/8555575039/4"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--81ccf402-8f1b-4a26-8be6-9e1301a17978",
            "value": "maskasd.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--369c7559-8d74-4bae-ac9b-60ac0857f208",
            "value": "teams.onweblive.org"
        },
        {
            "type": "email-addr",
            "spec_version": "2.1",
            "id": "email-addr--7c75adff-0e0b-4e6a-a851-69d3d66b3b7e",
            "value": "ehindero2016@tutamail.com"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--ad58f665-2d60-592c-9ad6-a6ba3b636760",
            "created": "2026-06-25T18:00:54.110136Z",
            "modified": "2026-06-25T18:00:54.110136Z",
            "name": "SapphireSleet"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--ce22de46-f801-4a60-82ca-60cef17c3562",
            "created_by_ref": "identity--a361b290-d09a-4e0e-a13d-681ca0c3dcc7",
            "created": "2026-06-25T18:00:54.129616Z",
            "modified": "2026-06-25T18:00:54.129616Z",
            "name": "From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet",
            "published": "2026-06-17T00:00:00Z",
            "object_refs": [
                "identity--a361b290-d09a-4e0e-a13d-681ca0c3dcc7",
                "file--1c557bdf-379a-44dc-a0e1-d5ded122fb4e",
                "file--43d934c8-1650-4b14-aa97-45a88a0cde4e",
                "url--ba013c36-9b6e-4b21-bd99-3c5f684f5845",
                "ipv4-addr--b65a715f-2d52-4218-a4c2-c9cbadde923a",
                "ipv4-addr--8a8d00b1-00b9-4f71-ab55-b7bf3734edcf",
                "file--fe5ba5d9-3600-46c4-baf6-212a667923e6",
                "file--58c0280d-cac6-4a46-bd62-b776e8d1f294",
                "file--743d6624-8ca7-489e-8b22-e88d1634ee27",
                "file--b8f8c564-78c3-40b3-a716-1a07669617cb",
                "file--be59e800-62da-4b1d-b9ab-3df91626cba8",
                "email-addr--59981efc-dfde-4a77-8559-acc8a874404f",
                "url--871fc01c-c5c5-44b1-86cb-2a69a259507c",
                "url--e8628e82-162c-4958-a296-94a0de4ebea9",
                "domain-name--81ccf402-8f1b-4a26-8be6-9e1301a17978",
                "domain-name--369c7559-8d74-4bae-ac9b-60ac0857f208",
                "email-addr--7c75adff-0e0b-4e6a-a851-69d3d66b3b7e",
                "threat-actor--ad58f665-2d60-592c-9ad6-a6ba3b636760"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/"
                }
            ]
        }
    ]
}