Socket: 141 Mastra npm Packages Compromised via Typosquatted Dependency

What it is

A supply chain attack against the Mastra npm scope. On 2026-06-17, between ~01:15 and 02:36 UTC, a single human npm account (ehindero) mass-published malicious versions of 141 @mastra/* packages — normally released only by the project's GitHub Actions CI. The @mastra/* code itself is byte-for-byte identical to the last legitimate build; the only functional manifest change is one added dependency, easy-day-js, a typosquat of dayjs. @mastra/core alone sees ~918K weekly downloads.

How it works

The malicious logic lives entirely on the transitive dependency, so npm install of any compromised package executes it before app code is imported.

• easy-day-js@1.11.21 (published a day earlier, 2026-06-16, by a separate account sergey2016) is a clean copy of dayjs with no hook — used to build benign history.
• easy-day-js@1.11.22 adds "postinstall": "node setup.cjs --no-warnings".

Stage 1 (setup.cjs, obfuscated via obfuscator.io) sets NODE_TLS_REJECT_UNAUTHORIZED='0', beacons the victim path/campaign marker to temp files, fetches stage 2 from C2 23.254.164.92:8000, writes it to a random temp filename, spawns it detached (passing exfil target 23.254.164.123:443), then self-deletes.

Stage 2 (protocal.cjs, ~41 KB) is a cross-platform tasking client, not a fire-and-forget stealer: it installs login persistence (Windows/macOS/Linux) and beacons back to run whatever follow-on code the operator returns. It steals browser history and stored data from 160+ crypto wallet extensions.

Preconditions / Affected

Any workstation, CI runner, or build environment that ran npm install pulling an affected @mastra/* version in the exposure window. Note the article cites 141 affected packages though the title says 140+; not every package in the scope was hit.

What to do

Treat any host or CI runner that ran the install as compromised:

• Remove the affected versions, delete node_modules, reinstall a known-good prior version.
• Rotate credentials that may have been exposed during install: npm tokens, cloud provider keys, CI/CD secrets, and SSH and Git credentials.

Detection artifacts: temp files .pkg_history and .pkg_logs, connections to 23.254.164.92:8000 and 23.254.164.123:443.

Caveats

Socket flagged the malicious easy-day-js within six minutes of publication and blocks it automatically for its customers. The investigation is ongoing — Socket says it is "still analyzing exact impact" and maintains a live campaign page for the authoritative affected-version list; do not treat any partial list here as complete. The clean-then-weaponize dependency pattern mirrors the recent axios campaign.