🎯 Malicious postinstall script

The items that name it 4

• Over 140 popular Mastra npm Packages Hit by Supply Chain Attack
  writeup2026-06-17

  Version 1.11.22 adds a postinstall hook running an obfuscated setup.cjs that executes automatically at install time without user interaction

• A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope
  writeup2026-06-16It is written here as Malicious postinstall script (dependency confusion carrier).

  A single unused dependency line was injected into each package.json at publish time (not in source), pulling in easy-day-js purely to trigger its postinstall dropper

• Why EDR and proxy won’t save you from supply chain malware
  article2026-06-02

  Package install hook (e.g. via npm install) executes malicious code with full permissions, such as reading .env files and POSTing contents to an attacker, or fetching and running a RAT

• TanStack npm Brand-Squat
  writeup2026-05-06

  postinstall.js with obfuscated function name sendReadme() executed at npm install time to run malicious code