Executive Summary
On June 17, 2026, a coordinated supply chain attack compromised over 140 packages within the @mastra namespace on npm. The attack was facilitated by a single account, 'ehindero', which added a malicious dependency named 'easy-day-js'—a typosquat of the popular 'dayjs' library—to the project manifests. This malicious dependency uses a postinstall hook to execute a multi-stage infection chain during the 'npm install' process, independent of whether the code is ever actually imported or run.
Technical analysis reveals a two-stage payload: an obfuscated loader (setup.cjs) that disables TLS verification to download a second-stage implant (protocal.cjs). This implant is a cross-platform Node.js tasking client that installs persistence on Windows, macOS, and Linux. It is designed to inventory over 160 cryptocurrency wallet extensions and exfiltrate browser history from Chrome, Edge, and Brave.
This campaign represents a significant risk to developer environments and CI/CD pipelines, particularly given that '@mastra/core' alone averages over 900,000 weekly downloads. Organizations using Mastra should immediately audit their environments for the affected versions and the presence of the 'easy-day-js' dependency, treating any system that performed an installation as fully compromised.