@mastra/node-speaker version 0.1.1 is a PCM audio output library that declares 'easy-day-js' as a runtime dependency despite no code requiring it, indicating suspicious behavior. The package's own code is benign, with no network activity or obfuscation, but the risk arises from the 'easy-day-js' dependency, which may be malicious. According to the GHSA advisory, any system with this package installed should be treated as fully compromised, requiring secret/key rotation and package removal. There is no direct evidence of exploitation in the wild, and no CVSS score is assigned.

Systems with @mastra/node-speaker 0.1.1 installed may be fully compromised due to the malicious nature of the 'easy-day-js' dependency. Attackers may have gained full control, risking exposure of all secrets and keys stored on the system. Removal of the package alone may not remove all malicious artifacts or backdoors introduced by the dependency.

Remove the @mastra/node-speaker package version 0.1.1 immediately. Rotate all secrets and keys from a separate, uncompromised system. Assess and remove any additional malicious software that may have been installed as a result of this package. Since no official patch or fix is available, avoid using this package and monitor vendor advisories for updates.