Mastra NvmProtocal Registry Persistence

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•9

Identifies the creation or modification of the 'NvmProtocal' registry value within the CurrentVersion\Run key. This mechanism is used by the cross-platform infostealer associated with the compromised Mastra npm packages to maintain persistence across system reboots.