Mastra npm Supply Chain Compromise via easy-day-js Dependency

Lourenço Santos@lourenco

•updated Jun 17, 2026•0•0•6

Detects indicators of the June 2026 Mastra npm supply chain attack, in which 144 @mastra/* packages were compromised by injecting a typosquatted dependency 'easy-day-js' (a clone of the dayjs date library) carrying an obfuscated postinstall infostealer. The payload disables TLS validation, fetches a second-stage payload, executes it as a detached process, and self-deletes. Detection targets the malicious dependency reference, the postinstall execution chain, and TLS-validation-disabling behaviour.