Mastra compromised in npm supply chain attack
On June 17, 2026, the open-source TypeScript AI framework Mastra suffered a supply chain attack after an attacker hijacked a former contributor's npm account to publish compromised updates. The malicious updates added a dependency on easy-day-js, a typosquatted library that executed a postinstall script to deploy a remote access trojan targeting LLM API keys and developer credentials.
AI frameworks represent high-value targets for attackers because their environments contain highly sensitive LLM API keys and cloud credentials.
* Hijacking inactive contributor accounts remains a highly successful vector for npm package takeovers.
* Typosquatting dependencies with postinstall scripts allows attackers to inject malware while keeping the parent package's code unchanged.
* Teams using affected packages must treat their environments as fully compromised and immediately rotate all active credentials.
DISCOVERED
3d ago
2026-06-17
PUBLISHED
3d ago
2026-06-17
RELEVANCE
AUTHOR
mastra