🧰 @mastra/core

The items that name it 5

• Socket: 141 Mastra npm Packages Compromised via Typosquatted Dependency
  writeup2026-06-20
• Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat
  writeup2026-06-18

  Specific Mastra package installed during StepSecurity's controlled GitHub Actions test to validate the malware's runtime behavior

• Mastra Attack Targets Crypto, Password Managers, Authenticators, and Zapier
  writeup2026-06-18

  ~918K weekly downloads; part of the @mastra npm scope, republished with malicious easy-day-js dependency

• Over 140 popular Mastra npm Packages Hit by Supply Chain Attack
  writeup2026-06-17

  918K weekly npm downloads

• A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope
  writeup2026-06-16It is written here as @mastra/core (npm package).

  ~4 million downloads/month, hundreds of dependent projects; compromised version @mastra/core@1.42.1; clean version restored to 1.42.0 (latest dist-tag)