The OpenSourceMalware Show: #9

**Executive summary:** The OpenSourceMalware show documents an active supply‑chain compromise of the Mastra npm organization where attackers pre‑staged a typosquatted package (easy-day-js) and added it as a dependency across 116 packages to deliver a two‑stage info‑stealer focused on browser extensions (including major password managers), MFA tools and integrations like Zapier; the episode also warns about "agentjacking" (prompt injection via MCP/Sentry logs) and dispels common malware myths while stressing the value of attribution for incident response.