A critical supply chain attack was disclosed affecting the entire @mastra/* npm scope, allowing attackers to deploy a cross-platform infostealer on any system that installed affected packages. Due to the potential for credential theft, cryptocurrency wallet compromise, and full system persistence, immediate remediation is required for all affected environments.

Technical Overview

The issue originates from a hijacked npm contributor account (“ehindero”) whose publishing access to the @mastra scope was never revoked. On June 17, 2026, the attacker executed an 88-minute automated campaign (01:12–02:39 UTC), republishing 142 packages under the @mastra scope with a single injected dependency: “easy-day-js”, a typosquat of the legitimate dayjs library. The day before, the attacker published a clean easy-day-js@1.11.21 to establish credibility, then weaponized it as v1.11.22 minutes before the mass-publish. Because compromised packages pinned “^1.11.21”, npm’s semver resolution automatically pulled the malicious version.

The malicious easy-day-js contained an obfuscated postinstall hook (setup.cjs) that disabled TLS verification, wrote beacon markers to temp directories, fetched a second-stage payload from attacker C2 infrastructure, spawned it as a detached background process, and self-deleted to hide forensic evidence. By exploiting npm’s install-time script execution, attackers gained the ability to harvest browser data from Chrome, Edge, and Brave, extract credentials from 166 cryptocurrency wallet extensions (including MetaMask, Phantom, Coinbase, and Binance), perform full host reconnaissance, establish cross-platform persistence, and exfiltrate all collected data to attacker infrastructure. No user interaction beyond running “npm install” is required for compromise.

Affected Systems

The following components are affected: all 142 packages under the @mastra/* npm scope, plus the top-level “mastra” and “create-mastra” packages. The malicious dependency easy-day-js@1.11.22 is the direct vector. These packages are used by developers building AI applications with the Mastra framework, which has combined weekly downloads exceeding 1.1 million. The highest-impact package is @mastra/core with approximately 918K weekly downloads. Any developer workstation, CI runner, or build system that installed any @mastra/* package after June 16, 2026 is potentially compromised.

Organizations should treat any affected system as fully compromised. Remediation steps include rolling back to pre-incident package versions, rotating all credentials (npm tokens, GitHub tokens, cloud provider keys, LLM API keys, CI/CD secrets, SSH keys, and database credentials), migrating cryptocurrency wallet funds to new wallets generated on clean devices, and removing persistence artifacts. On Windows, check the HKCU registry Run key and C:\ProgramData\NodePackages\. On macOS, check ~/Library/LaunchAgents/com.nvm.protocal.plist and ~/Library/NodePackages/. On Linux, check ~/.config/systemd/user/nvmconf.service and ~/.config/NodePackages/. Network IOCs to block include 23.254.164.92 and 23.254.164.123 (Hostwinds, ASN AS54290). Run “npm ls easy-day-js” in all projects for rapid detection.

Risk Impact

At the time of writing, the attack has been publicly documented by JFrog, SafeDep, Socket, and StepSecurity, and the malicious packages have been flagged. Tradecraft overlaps with Sapphire Sleet/BlueNoroff have been noted by Microsoft. Regardless of attribution, the severity and ease of exploitation make this incident high risk, especially for organizations with large JavaScript/TypeScript codebases and CI/CD pipelines that pull npm dependencies automatically. Successful exploitation allows attackers to steal credentials and secrets, compromise cryptocurrency wallets, establish persistent access across all major operating systems, and execute arbitrary code remotely, leading to service disruption, data exposure, and potential full infrastructure compromise.

How Orca Can Help

Orca enables customers to quickly identify assets running compromised @mastra/* package versions and detect the presence of the malicious easy-day-js dependency across cloud workloads, container images, and CI/CD pipelines. Orca’s Software Composition Analysis (SCA) capabilities flag affected packages, while malware detection identifies persistence artifacts and suspicious network connections to the known C2 infrastructure. Orca’s platform highlights affected assets directly in the newItem view, helping security teams understand their exposure in context, including internet accessibility, runtime reachability, and asset criticality, and prioritize remediation based on real risk.