Hackers Compromise 140+ Mastra npm Packages to Steal Credentials

An active npm supply-chain attack compromised 141 @mastra/* packages by adding a malicious transitive dependency (easy-day-js) that executes a postinstall downloader. The second-stage Node.js implant establishes cross-platform persistence, harvests 166 cryptocurrency wallet extensions, browser history, and developer credentials, and exfiltrates data to attacker-controlled IPs; Microsoft and Socket independently confirmed the campaign and the report provides IOCs and mitigation steps.