The Mastra supply chain attack wasn't about AI

In June 2026, a maintainer account compromise in the @mastra npm scope led to over 140 packages being republished with a malicious dependency ('easy-day-js') that used npm lifecycle hooks to execute, spawn a detached second-stage payload, and perform credential theft and malware delivery; the report emphasizes this as a conventional supply-chain attack affecting AI frameworks and recommends controls such as allowlisting and ringfencing to limit what trusted runtimes may do.