Mastra npm: 144 packages compromised via supply chain

A serious software supply chain has hit the Mastra npm namespace, with 144 packages of the popular JavaScript/TypeScript framework for artificial intelligence applications compromised. According to findings from JFrog, SafeDep, Socket , and StepSecurity, the attack — codenamed easy-day-js — exploited an old contributor account to distribute malicious code to hundreds of thousands of users worldwide. It is one of the largest supply chain attacks recorded in the npm in 2026.

See also: Miasma: New supply chain attack compromises Red Hat npm packages

The attack was discovered on June 17, 2026, when a single npm account named ehindero massively published more than 140 malicious packages into the Mastra npm scope in a very short period of time. This account belonged to a legitimate former Mastrawhose access rights had never been revoked — a classic example of poor access management in open source projects. This loophole is often the weak point in large open source projects, where contributors change but their rights remain active for months or even years.

Notably, the infected packages themselves did not contain any malicious code directly. Instead, the malicious code was introduced via a third-party library, easy-day-js , which was added to the dependency list of each package. This library was initially published on June 16, 2026 at 7:05 AM UTC by user sergey2016 as a clean, fully functional copy of the well-known dayjs library . The malicious changes were introduced just a few hours later, on June 17, 2026 at 1:01 AM UTC , leveraging dependency confusion and typosquatting to mislead developers.

Mastra npm: How the malicious attack chain works

The easy-day-js package executes an obfuscated payload during a postinstall hook — that is, immediately after installation, before the developer has even used the package. This payload acts as a dropper or loader for a second stage attack, which is retrieved from an attacker-controlled infrastructure at 23.254.164[.]92 , while disabling TLS certificate verification to avoid detection. The fact that it executes during installation means that systems are exposed even if the developer never includes the package in their code.

See also: Mini Shai-Hulud attacks AntV npm packages via compromised account

The final stage of the attack is a cross-platform information stealer with extensive capabilities. Specifically, it can collect browsing history, steal data from more than 160 browser extensions for cryptocurrency wallets, install persistence on Windows, macOS , and Linux, and export all collected information to the C2 server at 23.254.164[.]123. After execution, the loader deletes itself as a detached background process to minimize forensic traces and make analysis by incident response teams difficult.

SafeDep identified a critical security flaw in the publishing process: Mastra generates SLSA provenance attestations for official releases published via CI with the npm trusted publisher flow , but did not require these verifications as mandatory. This meant that a simple npm token could publish packages without attestations. A policy that required signature verification — via npm audit signatures or a policy that enforced attestations — would have rejected every malicious package from this campaign, preventing the attack entirely.

The scale of the potential damage is significant: the @mastra/core receives over 918,000 weekly downloads in the Mastra npm registry, giving this campaign a huge potential impact. Any workstation, CI runner , or build environment that installed the affected versions should be considered potentially compromised. npm has already removed the malicious versions from the most popular packages and is restoring the latest tags to the safe versions.

For organizations and developers using Mastra npm, experts recommend taking specific protective measures immediately. First, roll back to verified safe versions and check package-lock.json for suspicious dependencies. Second, immediately rotate all API keys, tokens , and credentials that were accessible from the affected environments. Third, fully audit systems for artifacts associated with the C2 . Finally, enable mandatory provenance attestations on all npm installations to prevent similar attacks in the future.

See also: 'Mini Shai-Hulud': SAP-Related npm Packages Compromised with Credential Stealer

This attack is a stark reminder of the dangers of open source project access management and blind trust in third-party dependencies. The broader open source community must adopt stricter policies for revoking access rights of former contributors, mandating the use of provenance attestations , and regularly auditing each project’s dependencies. In a world where AI frameworks like Mastra are gaining increasing adoption, securing the software supply chain is becoming a critical priority for every development team.