easy-day-js Targets Mastra, Dependency Attacks Grow

Security researchers identified a supply-chain campaign (tracked by Sonatype) in which attackers compromised part of the Mastra npm publishing workflow and added a malicious dependency, easy-day-js, to many Mastra packages; the package’s postinstall script attempted to download and execute a second-stage payload, potentially compromising developer workstations, CI/build agents, and production-adjacent environments.