More than 140 Mastra npm packages were compromised through a supply chain attack involving a typosquatted dependency called easy-day-js. A single npm account published malicious versions rapidly, affecting widely used packages such as @mastra/core. The attack leverages the npm postinstall hook to execute a two-stage payload: first disabling TLS validation and then downloading a second-stage implant that establishes persistence across Windows, macOS, and Linux platforms. This implant functions as a command-and-control client that steals cryptocurrency wallet inventories from 166+ browser extensions, collects browser history, and can execute arbitrary commands from operators. The malicious code runs before developers import the packages, compromising systems during installation.

Systems installing affected Mastra npm packages are compromised during the installation process. The attack disables TLS validation, enabling the download of a second-stage implant that persists across multiple operating systems. This implant steals sensitive cryptocurrency wallet information from numerous browser extensions, harvests browser history, and allows remote code execution by threat operators. This results in potential theft of digital assets, privacy breaches, and full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or update is available, developers should avoid installing or updating affected Mastra npm packages, especially those depending on the easy-day-js dependency. Verify package integrity and source authenticity before installation. Monitor official npm advisories and trusted security sources for updates and remediation instructions.