MalwarePublished 17 Jun 2026Updated 8 Jul 2026

@mastra/node-speaker (npm) · Malicious Code

Affects @mastra/node-speakerSource GCVE Database

Malicious package : remove @mastra/node-speaker and rotate any secrets on hosts that installed it.

Data as of 9 Jul 2026, 09:55 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6055

What to do

Remove @mastra/node-speaker from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@mastra/node-speaker	Affected =0.1.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @mastra/node-speaker version 0.1.1 includes a suspicious runtime dependency on 'easy-day-js', a date utility library unrelated to its declared audio output functionality. While @mastra/node-speaker's own code appears benign with no direct malicious behavior, the inclusion of this unrelated dependency raises concerns about potential malicious activity. The 'easy-day-js' package itself should be separately assessed for maliciousness. Installation of @mastra/node-speaker 0.1.1 may lead to full system compromise, and any system with this package installed should be considered compromised. Immediate secret and key rotation is recommended, and removal of the package is advised, though removal may not fully eliminate the compromise.

Impact

Systems with @mastra/node-speaker 0.1.1 installed may be fully compromised due to the malicious nature of the 'easy-day-js' dependency. Attackers may have gained full control, risking exposure of all secrets and keys stored on the system. Removal of the package alone may not remove all malicious artifacts or backdoors introduced by the dependency.

Defensive guidance

Remove the @mastra/node-speaker package version 0.1.1 immediately. Rotate all secrets and keys from a separate, uncompromised system. Assess and remove any additional malicious software that may have been installed as a result of this package.

Summary

@mastra/node-speaker version 0.1.1 is a PCM audio output library that declares 'easy-day-js' as a runtime dependency despite no code requiring it, indicating suspicious behavior. The package's own code is benign, with no network activity or obfuscation, but the risk arises from the 'easy-day-js' dependency, which may be malicious. According to the GHSA advisory, any system with this package installed should be treated as fully compromised, requiring secret/key rotation and package removal. There is no direct evidence of exploitation in the wild, and no CVSS score is assigned.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 9 Jul 2026, 09:55 UTC

Technical details

References

Community reviews