CampaignPublished 17 Jun 2026

the entire @mastra npm scope got hijacked last night with 141 packages including @mastra/core

Source Reddit Malware

Discussion

The entire @mastra npm scope was hijacked, affecting 141 packages including @mastra/core. The attacker did not modify the original source code but added a malicious dependency named easy-day-js, a seemingly benign dayjs clone. The attack exploited semantic versioning by specifying a dependency version range (^1.11.21) while the latest tag pointed to a newer version (1.11.22) containing a malicious postinstall hook. This allowed the malicious code to execute during package installation without immediate detection.

r/Malware (opens in a new tab)u/BattleRemote31570 points0 comments

The attacker didn't touch any Mastra source code but just added one dependency to every package: easy-day-js which is a clean-looking dayjs clone. The trick was in semver that is they pinned ^1.11.21 but the latest tag pointed to 1.11.22 which had a postinstall hook. You audit 1.11.21but npm installs 1.11.22.

full details - https://safedep.io/mastra-npm-scope-takeover-supply-chain-attack/

Links cited in the discussion

https://safedep.io/mastra-npm-scope-takeover-supply-chain-attack/

Impact

The compromise of the @mastra npm scope affects all users and projects relying on any of the 141 hijacked packages, including @mastra/core. The malicious postinstall hook in the easy-day-js dependency could execute arbitrary code during installation, potentially leading to supply chain compromise, unauthorized code execution, or further malware deployment. No known exploits in the wild have been reported at this time.

Defensive guidance

Users should audit their dependencies carefully, especially those with semver ranges that may resolve to newer, unreviewed versions. Temporarily avoid using affected packages until a fix or official guidance is provided. Consider pinning dependencies to exact versions verified as safe.

Summary

This campaign involved a supply chain attack on the @mastra npm scope where 141 packages were compromised. The attacker inserted a malicious dependency (easy-day-js) that appeared legitimate but contained a postinstall hook in version 1.11.22. The dependency was specified with a semver range (^1.11.21), so users auditing version 1.11.21 would not detect the malicious code, yet npm installed the newer 1.11.22 version. This technique allowed the attacker to execute code during package installation without altering the original package source code.

References

Community reviews

Loading reviews…

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 17 Jun 2026, 17:50 UTC

Technical details

References

Community reviews

Related threats