Hijacked account compromises Mastra npm packages

Supply chain security remains the soft underbelly of open-source development, and even modern frameworks like Mastra are highly vulnerable to contributor-focused credential hijacking.

• –**Hijacked Credentials over Direct Compromise:** Attackers bypassed source code audits by compromising a former contributor's npm account, highlighting that developer account hygiene is as critical as code reviews.
• –**Sophisticated Multi-Stage Payload:** Using `easy-day-js` as a typosquatted middleman shows attackers are using indirect dependencies to evade detection by scanners that only inspect primary codebase changes.
• –**Cross-Platform Persistence & Stealer Activity:** The malware's ability to target Windows, macOS, and Linux, while harvesting credentials and crypto wallets, shows a high level of preparation and coordination.