Malware in @mastra/deployer-vercel

A malicious version of the npm package @mastra/deployer-vercel has been identified and published to the npm registry. The package contains malware that grants full control of affected systems to an outside entity.\n\nAny computer with this package installed or running should be considered fully compromised. The malware may have exfiltrated or accessed all secrets, keys, and sensitive data stored on the affected system.\n\nImmediate action is required: all secrets and keys should be rotated from a different, unaffected computer. While the package should be removed, complete removal of all malicious software cannot be guaranteed due to the level of system compromise.\n\nThis incident was disclosed via GitHub Advisory GHSA-phgx-m87g-gqmf on 2026-06-17.