Node.js Malicious Script Execution (Mastra npm Supply Chain Compromise)

nomit vyas@xoxo

•updated Jun 24, 2026•3•0•10

Detects Node.js executing the malicious 'setup.cjs' script with the '--no-warnings' flag. This execution sequence is associated with the 'easy-day-js' typosquat postinstall hook used in the Mastra npm supply chain compromise.