Mastra supply chain attack: The importance of scope access and account hygiene

A supply-chain attack against the @mastra npm scope used a typosquatted package ('easy-day-js') and a compromised maintainer account to republish over 140 packages, deploying a two-stage Node.js infostealer that performs OS-specific data collection (browser data, password managers, crypto wallets), establishes persistence on Windows/macOS/Linux, and communicates with hardcoded C2 hosts and DGA domains; the report includes network and file IOCs, SHA-256 hashes, and remediation/mitigation recommendations.