Reported by 1 outlet
Mastra AI Framework npm Supply Chain Attack — easy-day-js Backdoors 140+ Packages, Postinstall Drops RAT Payload
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Mastra AI Framework npm Supply Chain Attack — easy-day-js Backdoors 140+ Packages, Postinstall Drops RAT Payload
stepsecurity.io · 118d ago · June 18th, 2026
Attackers compromised the @mastra npm organization and silently added easy-day-js (a typosquatted copy of the legitimate
dayjsdate library) as a dependency across 141 packages in an 88-minute window on June 17. Mastra is a popular open-source AI agent framework —@mastra/corehas 918K weekly npm downloads. The maliciouspostinstallhook executes automatically duringnpm installwithout the application needing to import the package, downloading and running a second-stage RAT from attacker-controlled infrastructure.This continues the pattern established by the Axios compromise and Atomic Arch campaign: trusted packages used as delivery vehicles for malicious dependencies. Any host where the affected packages were installed should be treated as compromised — credentials rotated, lockfiles regenerated from known-good versions, and developer workstations, CI runners, and build agents investigated for persistence mechanisms.