Mastra Packages Trojanized with Malicious Dependency (Campaign)

On 17 June 2026, attackers hijacked a maintainer account for the Mastra npm organization and republished 116 packages within ~27 minutes, adding a typosquatted dependency ('easy-day-js') that executed an obfuscated postinstall loader; the loader disabled TLS checks, downloaded and launched a second-stage cross-platform infostealer that harvests browser data and over 160 cryptocurrency wallet extensions and establishes persistence, posing a large-scale supply-chain risk due to Mastra's broad usage and high download volume.