Searching for Mastra npm hack, easy-day-js malware, or @mastra supply chain attack June 2026? On June 17, 2026, attackers republished 141 packages in the npm @mastra scope overnight—without touching Mastra’s GitHub source. The payload rode in on a single swapped dependency: typosquatted easy-day-js instead of legitimate dayjs.
Breaking — June 17, 2026: Security vendors including Socket, StepSecurity, and OX Security disclosed a coordinated npm supply-chain attack against Mastra—an open-source AI agent framework with millions of monthly downloads. BreachHistory indexes every compromised package version at pkg-npm-mastra-easy-day-js-202606.
What happened
The attacker did not modify Mastra application source in Git. Instead they:
- Published typosquatted
easy-day-js—mirroring dayjs metadata (author, homepage, repo URL, version numbering) to pass casual review. - Shipped a clean bait version
[email protected]on June 16, then weaponized1.11.22with a maliciouspostinstallhook (node setup.cjs). - Compromised dormant former contributor account ehindero and mass-republished 141 @mastra packages between roughly 01:12–02:39 UTC on June 17, each declaring
"easy-day-js": "^1.11.21"so npm resolved the caret range to the malicious dropper.
Account sergey2016 uploaded the malicious npm package; reporting ties both accounts to tutamail.com email substitution consistent with takeover. Legitimate prior @mastra releases carried GitHub OIDC provenance; compromised versions published from ehindero lacked SLSA attestations—a red flag teams can enforce in policy.
Payload: two-stage RAT, not a simple stealer
Stage 1 is setup.cjs—roughly 4.5 KB of heavily obfuscated JavaScript run at install time. It disables TLS verification, beacons install paths, fetches stage 2 from 23.254.164.92:8000, spawns a detached background process pointed at C2 23.254.164.123:443, then deletes itself from disk.
Stage 2 is a cross-platform Node.js remote access trojan (~41 KB) that:
- Installs OS-level persistence (Windows Run key, macOS LaunchAgent, Linux systemd user unit)—surviving
npm uninstall - Inventories 166 cryptocurrency wallet browser extensions and harvests browser history from Chrome, Brave, and Edge
- Exfiltrates host, process, and environment reconnaissance—including high-value LLM API keys and cloud/CI credentials common in AI dev stacks
- Polls for operator commands to download and execute arbitrary follow-on modules
Socket flagged easy-day-js within six minutes of publication; StepSecurity demonstrated blocking the outbound C2 prevented stage-2 download entirely. There is no CVE—CVE scanners had no detection surface during active exploitation.
Scale and who is at risk
OX Security cited ~8 million combined weekly downloads and ~29 million monthly across affected packages; @mastra/core alone exceeds 900,000 weekly installs. Anyone who ran npm install on a @mastra package during the June 17 exposure window—developer laptops, CI runners, cloud build agents—is in scope. Mastra targets AI agent workflows, so compromised hosts often hold OpenAI, Anthropic, and Google API keys alongside npm and GitHub tokens.
Representative compromised versions
@mastra/[email protected](prior clean: 1.42.0)@mastra/[email protected],@mastra/[email protected],@mastra/[email protected][email protected],[email protected]- Malicious dependency:
[email protected]
Full per-package version pins (142 artifacts): BreachHistory supply-chain manifest.
Immediate action checklist
- Audit dependency trees:
npm ls easy-day-jsacross repos and CI images. - Pin or downgrade every @mastra package to the last provenance-verified release before June 17, 2026.
- Treat affected hosts as compromised—do not assume uninstalling node_modules is sufficient.
- Rotate secrets: LLM API keys, cloud credentials, npm tokens, GitHub PATs, SSH keys, and database URLs present on infected machines.
- Hunt persistence: Windows
HKCU\Run(NvmProtocal), macOS~/Library/NodePackages/protocal.cjs, Linux~/.config/systemd/nvmconf/. - Block egress to
23.254.164.92and23.254.164.123at firewall/proxy. - Review CI logs for npm install steps between 01:00–03:00 UTC June 17, 2026.
Why dependency-only attacks are hard to spot
This campaign highlights a structural gap: package tarballs looked like normal semver bumps from a known maintainer handle, and only one dependency field changed. Typosquats copied dayjs metadata so npm audit and visual lockfile review often showed nothing alarming. Install-time scripts execute before your application imports any @mastra code—so runtime SAST never runs. Teams should enforce provenance attestation requirements, block postinstall scripts in CI where feasible, and monitor registry publishes on scoped packages they depend on.
FAQ
Did Mastra confirm the incident?
Third-party researchers and npm security vendors published detailed analyses June 17; check Mastra’s official channels for vendor statements as they emerge.
Is this related to Shai-Hulud or node-ipc?
No—distinct campaign, distinct payload (easy-day-js typosquat), and distinct access vector (dormant @mastra maintainer token rather than atool or node-ipc maintainer abuse).
Can I just delete easy-day-js from node_modules?
Not safely. The RAT installs OS persistence outside node_modules; assume full host compromise until forensics clears the machine.
Canonical supply-chain record: Mastra / easy-day-js June 2026 on BreachHistory.
Sources: OX Security, Socket, StepSecurity, Phoenix Security
Updated 2026-06-19.