Scale and timing: what the defenders reported
Multiple security teams — JFrog, SafeDep, Socket, and StepSecurity — say as many as 144 npm packages in the Mastra namespace ("@mastra/*") were compromised in a supply chain campaign codenamed easy-day-js. The attack unfolded across two days: an npm user named "sergey2016" published an initial, clean copy of a library named "easy-day-js" on June 16, 2026 at 7:05 a.m. UTC, and malicious changes were introduced the next day on June 17, 2026 at 1:01 a.m. UTC. Socket reported that the "ehindero" account mass-published more than 140 malicious packages on June 17 in a short window.
The malicious library and multi-stage payload
The compromised packages did not carry their own malicious code; instead, the attackers added a dependency named "easy-day-js" to each package. That library contains an obfuscated payload that runs during the install process via a postinstall hook. According to the reporting, the postinstall dropper disables TLS certificate validation, retrieves a second-stage payload from attacker-controlled infrastructure at "23.254.164[.]92", and launches that payload as a detached background process before erasing traces of the loader.
The final stage is a cross-platform information stealer capable of harvesting browser history, extracting stored data from more than 160 cryptocurrency wallet browser extensions, installing persistence across Windows, macOS, and Linux, and exfiltrating collected data to the command-and-control server at "23.254.164[.]123". SafeDep characterized "easy-day-js" as a clone of the "dayjs" date library that downloads and runs a cryptocurrency-stealing remote access trojan.
How the packages were pushed and why provenance mattered
Investigators say the campaign succeeded after the attackers hijacked the "ehindero" npm account, described as a legitimate former Mastra contributor whose scope access was never revoked. Mastra's normal releases, the reporting notes, are published from continuous integration (CI) systems using npm's trusted publisher flow and carry SLSA provenance attestations. The attacker published malicious versions using a personal npm token and deliberately dropped those provenance attestations.
SafeDep observed that a consistent fingerprint repeated across the compromised scope and concluded that because Mastra generated provenance on CI publishes but did not require it, a standard npm token could still publish without attestations. As the advisory explains, "A signature-verifying install (npm audit signatures, or a policy that requires attestations) would have rejected every package in this wave." Npm has since removed the malicious versions from the highest-profile packages and reverted their latest tag.
Operational risk: installs, CI runners, and reach of @mastra/core
Socket highlighted the potential blast radius by noting that affected packages include @mastra/core, which receives more than 918K weekly npm downloads. Because the payload executes during installation, systems can be exposed before developers ever import or run the package code. The reporting warns that "any workstation, CI runner, or build environment that installed the affected versions should be treated as potentially compromised."
Recommended immediate actions cited in the advisory include rolling back to a safe version, rotating any credentials, and auditing hosts for artifacts linked to the campaign.
What this means for technologists, package maintainers, and enterprises
- Technologists and security teams: treat installs of compromised versions as potential compromises, roll back to verified releases, rotate credentials, and search for the described artifacts and persistence mechanisms on affected hosts.
- Package maintainers: the incident underlines the risk of unrevoked scope access and the importance of enforcing CI-originated provenance; the report notes Mastra generated but did not require SLSA attestations, and the attacker used a personal token that bypassed those attestations.
- Enterprises and procurement leaders: prioritize policies that enforce signature-verifying installs (for example, "npm audit signatures" or equivalent policies requiring attestations) since, per SafeDep, such policies "would have rejected every package in this wave."
The easy-day-js incident is a blunt reminder that supply chain trust can be undermined not by new zero-days in source code but by the misuse of credentials and gaps in publishing policy. Npm's removal of the malicious versions and the reversion of tags address the immediate distribution vector, but the campaign's reliance on a legacy contributor token and the lack of enforced provenance raise concrete questions about token hygiene and deployment-time verification. For any organization that pulled packages from the Mastra scope on or after June 16–17, the practical next steps are already specified in the advisory: roll back, rotate, and audit — and consider making signature verification mandatory.
Original reporting: https://thehackernews.com/2026/06/144-mastra-npm-packages-compromised-via.html
