The 'mastraqqq' npm package is a typosquatting attack that clones the legitimate 'mastra' CLI version 1.13.0, including its metadata and README, but adds a covert dependency 'caspian-day-js@^1.11.22' that is never imported in the package code. This extra dependency is attacker-controlled and is smuggled into the consumer's install graph under the guise of the legitimate package, representing a canonical namespace abuse delivery method. The presence of this package indicates a full system compromise risk, as the attacker may have gained control beyond the package itself.

Any system with 'mastraqqq' version 1.13.0 or 1.13.1 installed should be considered fully compromised. The attacker-controlled dependency may execute malicious code, potentially exposing all stored secrets and keys. Immediate secret/key rotation is required from a clean environment. Removing the package does not guarantee removal of all malicious artifacts or backdoors introduced by the attacker.

Remove the 'mastraqqq' package immediately. Rotate all secrets and keys from a different, uncompromised computer. Because full system compromise is possible, conduct a thorough investigation and remediation beyond just uninstalling the package. No official patch or fix exists as this is a malicious package impersonation; avoid installing packages with suspicious or similar names to legitimate ones.