Over 140 popular Mastra npm Packages Hit by Supply Chain Attack

On June 17 a supply-chain attack republished 141 packages in the @mastra npm scope, adding a malicious dependency ([email protected]) that leverages a postinstall hook to download and execute a second-stage RAT; the dropper contacts C2 infrastructure (23.254.164.92:8000 / 23.254.164.123:443), targets over 160 browser crypto wallet extensions (e.g., MetaMask, Keplr, Coinbase), establishes cross-platform persistence, and self-deletes to evade forensics.