This campaign involved a supply chain attack on the @mastra npm scope where 141 packages were compromised. The attacker inserted a malicious dependency (easy-day-js) that appeared legitimate but contained a postinstall hook in version 1.11.22. The dependency was specified with a semver range (^1.11.21), so users auditing version 1.11.21 would not detect the malicious code, yet npm installed the newer 1.11.22 version. This technique allowed the attacker to execute code during package installation without altering the original package source code.

The compromise of the @mastra npm scope affects all users and projects relying on any of the 141 hijacked packages, including @mastra/core. The malicious postinstall hook in the easy-day-js dependency could execute arbitrary code during installation, potentially leading to supply chain compromise, unauthorized code execution, or further malware deployment. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory or official @mastra npm scope maintainers for current remediation guidance. Users should audit their dependencies carefully, especially those with semver ranges that may resolve to newer, unreviewed versions. Temporarily avoid using affected packages until a fix or official guidance is provided. Consider pinning dependencies to exact versions verified as safe.