🧰 easy-day-js

The items that name it 7

• Socket: 141 Mastra npm Packages Compromised via Typosquatted Dependency
  writeup2026-06-20
• The OpenSourceMalware Show #9
  talk2026-06-18It is written here as easy-day-js (npm package).

  Typosquatted package pre-staged by attackers, copied from a legitimate package, added as dependency to Mastra packages to deliver malware; original benign version (1.11.21 per hosts' check) left live on npm after malicious version removed

• JFrog: npm v12
  article2026-06-18

  typosquat of dayjs (47M weekly downloads)

• Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat
  writeup2026-06-18

  Typosquat of the dayjs date library, copying its version numbering, author metadata (iamkun), homepage, repository URL, license and keywords

• Mastra Attack Targets Crypto, Password Managers, Authenticators, and Zapier
  writeup2026-06-18

  Typosquat of the dayjs npm library; version 1.11.21 benign decoy, version 1.11.22 weaponized with malicious postinstall hook, tagged latest

• Over 140 popular Mastra npm Packages Hit by Supply Chain Attack
  writeup2026-06-17

  malicious version; 1.11.21 was clean

• A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope
  writeup2026-06-16It is written here as easy-day-js (malicious npm package).

  Dayjs impersonator; clean cover release 1.11.21 published June 16, 2026, malicious release 1.11.22 published June 17, 2026 and tagged latest; Snyk advisory SNYK-JS-EASYDAYJS-17353313, Embedded Malicious Code; removed from npm