144 Mastra npm Packages Compromised via Hijacked Contributor Account

## Executive Summary As many as 144 @mastra npm packages were compromised in a supply-chain campaign (easy-day-js) that injected a malicious dependency which executes an obfuscated postinstall loader to download a second-stage cross-platform information stealer; the malware harvests browser history, data from over 160 cryptocurrency wallet extensions, installs persistence on Windows/macOS/Linux, and exfiltrates data to attacker C2 servers (23.254.164.92 and 23.254.164.123).