The @mastra/core package at version 1.42.1 was identified as containing malicious code or relying on a malicious dependency. According to sources including Amazon Inspector and GHSA malware advisories, any system with this package installed or running should be considered fully compromised. The malicious code may allow an attacker full control over the system, necessitating immediate secret and key rotation from a secure environment. There is no known patch or fixed version available, and removal of the package alone may not eliminate all malicious components.

Systems with @mastra/core version 1.42.1 installed are at risk of full compromise. Attackers may gain complete control over the affected computer, potentially accessing or exfiltrating sensitive information such as secrets and keys. The compromise is severe enough that simply uninstalling the package does not guarantee removal of all malicious artifacts.

Remove the @mastra/core package version 1.42.1 immediately. Rotate all secrets and keys stored on the compromised system from a different, trusted machine. Because full system compromise is likely, consider rebuilding or thoroughly cleaning the affected system. No official patch or fixed version is currently available; monitor vendor advisories for updates.