The @mastra/server npm package at version 2.1.1 has been identified as containing malicious code or relying on a dependency that contains malicious code. According to the source data from Amazon Inspector and GitHub Security Advisories, any system with this package installed or running should be considered fully compromised. The malicious code presence implies that attackers may have gained full control over the affected system. Immediate remediation involves removing the package and rotating all secrets and keys from a separate secure environment. However, due to the potential persistence of malicious software, removal of the package does not guarantee full eradication of the threat.

Systems with @mastra/server version 2.1.1 installed or running are fully compromised. Attackers may have complete control over the system, risking exposure or theft of secrets, keys, and sensitive data. The compromise may allow persistent malicious activity beyond the presence of the package itself.

Remove the @mastra/server package version 2.1.1 from all affected systems immediately. Rotate all secrets and keys stored on the compromised systems from a separate, secure machine. Because full control may have been given to an attacker, further forensic analysis and system restoration from known good backups are recommended. Patch status is not confirmed; check vendor advisories for updates or safer package versions.