Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat
On June 17, 2026, an attacker compromised the @mastra npm organization and injected easy-day-js, a typosquat of the popular dayjs library, as a dependency across 140+ packages. The malicious package contained an obfuscated postinstall dropper that downloaded and executed a second-stage payload from attacker-controlled servers before self-deleting. The affected packages had a combined weekly download count exceeding 1.1 million.
- Disclosed
- Last updated
- Blast radius
- 140+ npm packages in the Mastra AI framework ecosystem with combined weekly downloads exceeding 1.1 million
- Ecosystems
- Attack vectors
- Affected entities
- @mastra (organization)140+ packages compromised; easy-day-js added as dependency
- easy-day-jsTyposquat of dayjs; contained obfuscated postinstall dropper
On June 17, 2026, the @mastra npm organization was compromised, and an attacker added easy-day-js as a dependency across 140+ packages within the Mastra AI framework ecosystem. easy-day-js is a typosquat of the legitimate dayjs date library, designed to deceive developers into installing the malicious package.
The malicious easy-day-js package contained an obfuscated postinstall script that executed during installation. This script downloaded and ran a second-stage payload from attacker-controlled servers, then deleted itself to remove evidence of the compromise.
The attack had significant reach: the affected @mastra packages combined for weekly download counts exceeding 1.1 million. Any installation of affected @mastra packages on June 17, 2026 or later would have resulted in execution of the malicious payload.
The incident represents a multi-vector supply chain attack combining account/organization compromise with typosquatting and automated malware delivery via postinstall hooks.
Indicators of compromise
- Packages
- easy-day-js
Remediation
- Immediately audit npm audit logs and package-lock.json files for installations of @mastra packages and easy-day-js on or after June 17, 2026
- Treat any environment where @mastra packages were installed as potentially compromised; perform forensic analysis for signs of second-stage payload execution
- Remove all @mastra packages and easy-day-js from affected environments
- Rotate all credentials, API keys, and secrets that may have been exposed on compromised systems
- Monitor for indicators of compromise from the attacker-controlled servers mentioned in the dropper
- Update to patched versions of @mastra packages once the organization regains control and publishes security updates
- Implement stricter npm package verification and dependency pinning practices
- Enable npm 2FA and organization-level access controls to prevent account takeover
Sources
Cite this entry
"Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed June 17, 2026; last updated June 20, 2026. https://supplychainattack.org/incident/mastra-npm-supply-chain-attack-140-packages-backdoored-via-easy-day-js-typosquat-o3zznw
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in @coralxyz/anchor (npm)
The npm package @coralxyz/anchor is a typosquatting attack impersonating the legitimate @coral-xyz/anchor Solana framework. It contains a postinstall hook that downloads and executes a malicious executable on Windows systems. The package provides no legitimate functionality and serves solely as a dropper for malware.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in blekit (npm)
The npm package blekit contained malicious code that silently exfiltrated application logs, GPS coordinates, device identifiers, and security posture to an attacker-controlled Telegram channel. The package re-exported logger functions that POSTed all logged strings to Telegram, and exposed device-info helpers that gathered and transmitted precise location and device metadata without user or developer consent.
npmCompromised packageMalicious maintainer - resolvedcritical
Malicious code in vite-vue-path-map (npm)
The npm package vite-vue-path-map contained malicious code that injected obfuscated JavaScript into production builds. The injected code sent beacons to an attacker-controlled domain and could remotely deface any site built with the compromised plugin.
npmCompromised packageMalicious maintainer - resolvedcritical
Malicious code in dolyame-ui-postcsscustomproperties (npm)
The npm package dolyame-ui-postcsscustomproperties contained malicious code that downloads and executes platform-specific binaries from attacker-controlled Cloudflare Workers and DNS infrastructure. The package typosquats the legitimate postcss-custom-properties package and disguises the malicious payload as an analytics/telemetry module.
npmCompromised packageTyposquatting