{"id":1343,"date":"2026-06-17T07:49:07","date_gmt":"2026-06-17T07:49:07","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1343"},"modified":"2026-06-17T07:49:07","modified_gmt":"2026-06-17T07:49:07","slug":"144-mastra-npm-packages-compromised-via-hijacked-contributor-account","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1343","title":{"rendered":"144 Mastra npm Packages Compromised via Hijacked Contributor Account"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Jun 17, 2026<\/span><\/span>Malware \/ Cryptocurrency<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

As many as 144 npm packages associated with the Mastra<\/a> namespace (\u00ab@mastra\/*\u00bb), a popular open-source JavaScript and TypeScript framework for building artificial intelligence (AI) applications, have been compromised as part of a software supply chain attack codenamed easy-day-js<\/b>, per findings from JFrog<\/a>, SafeDep<\/a>, Socket<\/a>, and StepSecurity<\/a>.<\/p>\n

\u00abA single npm account (ehindero) mass-published more than 140 malicious packages across the Mastra scope within a short window on 2026-06-17,\u00bb Socket said.<\/p>\n

The infected packages themselves do not include malicious code. Instead, it’s introduced by means of a third-party library named \u00abeasy-day-js\u00bb that has been added to each package’s dependency list. The JavaScript library was published by an npm user called \u00absergey2016\u00bb on June 16, 2026, at 7:05 a.m. UTC as a clean, fully functional copy, with the malicious changes introduced on June 17, 2026, at 1:01 a.m. UTC.<\/p>\n

The \u00abeasy-day-js\u00bb package launches an obfuscated payload that’s fired during a postinstall hook, which acts as a dropper or loader for a second-stage payload retrieved from attacker-controlled infrastructure (\u00ab23.254.164[.]92\u00bb) after disabling TLS certificate validation.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The payload is then executed as a detached background process, following which the loader takes steps to erase itself to minimize the forensic trail.<\/p>\n

The final stage is a cross-platform information stealer that can harvest browser history, store data from over 160 cryptocurrency wallet browser extensions, install persistence across Windows, macOS, and Linux, and exfiltrate the captured information to the C2 server (\u00ab23.254.164[.]123\u00bb).<\/p>\n

In its analysis, SafeDep described \u00abeasy-day-js\u00bb as a clone of the \u00abdayjs\u00bb date library that downloads and runs a cryptocurrency-stealing remote access trojan. The attackers behind the campaign are said to have hijacked the \u00abehindero\u00bb account, a legitimate former Mastra contributor whose scope access was never revoked. Npm has since pulled the malicious versions from the highest-profile packages and reverted their latest tag.<\/p>\n\n\n\n\n
\"\"<\/a><\/td>\n<\/tr>\n
Image Source: StepSecurity<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u00abMastra ships its real releases from CI through npm’s trusted publisher flow, and each one carries SLSA provenance attestations,\u00bb SafeDep said. \u00abThe attacker pushed the malicious versions from a personal token and dropped the provenance.\u00bb<\/p>\n

\u00abThe same fingerprint repeats across the whole scope. Mastra generated provenance on CI publishes but did not require it, so a standard npm token could still publish without attestations. A signature-verifying install (npm audit signatures, or a policy that requires attestations) would have rejected every package in this wave.\u00bb<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Any workstation, CI runner, or build environment that installed the affected versions should be treated as potentially compromised. It’s advised to roll back to a safe version, rotate any credentials, and audit the hosts for any artifacts linked to the campaign.<\/p>\n

\u00abThe affected packages include @mastra\/core, which receives more than 918K weekly npm downloads, giving this campaign a large potential blast radius,\u00bb Socket said. \u00abBecause the payload executes during installation, systems may be exposed before developers import or use the package.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Ravie Lakshmanan\ue802Jun 17, 2026Malware \/ Cryptocurrency As many as 144 npm packages associated with the Mastra namespace (\u00ab@mastra\/*\u00bb), a popular open-source JavaScript and TypeScript framework for building artificial intelligence (AI)…<\/p>\n","protected":false},"author":1,"featured_media":1344,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[573,227,2075,804,2074,39,35],"class_list":["post-1343","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-account","tag-compromised","tag-contributor","tag-hijacked","tag-mastra","tag-npm","tag-packages"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1343","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1343"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1343\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/1344"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1343"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1343"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1343"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}