OPEN LINK ↗
// 1h agoSECURITY INCIDENT
Supply chain attack hits 141 Mastra npm packages
A severe supply chain attack compromised 141 packages within the Mastra npm scope overnight. Attackers did not alter the existing source code; instead, they injected a malicious dependency named easy-day-js, which installs persistent malware (a remote access trojan) on the host machine upon package installation.
// ANALYSIS
- –Supply chain attacks via malicious dependencies continue to be a significant threat in the npm ecosystem.
- –The technique of preserving the original source code while slipping in a malicious dependency makes detection harder without thorough dependency auditing.
- –Developers using packages from the Mastra scope need to urgently review their dependencies and scan for potential compromise, particularly related to the easy-day-js package.
// TAGS
npmsupply-chain-attackmastramalwarecybersecurityremote-access-trojan
DISCOVERED
1h ago
2026-06-17
PUBLISHED
2h ago
2026-06-17
RELEVANCE
8/ 10
AUTHOR
IntCyberDigest
