Mastra npm Org Compromised: Multiple Packages Trojanized to Drop a Remote Payload via ...

A single hijacked maintainer account pushed multiple trojanized packages across the entire @mastra scope in 27 minutes, each carrying a typosquat dependency that runs a remote payload on install. Combined reach is over 28 million downloads a month.

An attacker took over the account of a Mastra maintainer and used it to tamper with the project at scale. Over a 27-minute window, they republished the entire @mastra catalog. They left Mastra's own code alone. In each package they changed a single line, adding a hidden link to a counterfeit component named easy-day-js , a lookalike of a widely used tool called dayjs . Mastra is an open-source toolkit that software developers use to build AI applications and agents. It comes from the team behind Gatsby and is widely adopted: the project's components are downloaded more than 28 million times a month by teams building on top of it. Like most modern software, Mastra is shipped as a set of small, reusable building blocks that other programs pull in automatically. That reach is what made one stolen account so dangerous.

easy-day-js is a typosquat. It impersonates dayjs down to the description and the bundled dayjs.min.js, but adds a postinstall hook that runs a dropper. On install, the dropper disables TLS certificate validation, fetches a second-stage payload from a raw IP address, writes it to the temp directory, runs it as a detached and hidden child process, and deletes itself.

Three things stand out this incident:

All versions below are malicious and were published 2026-06-17. Pin to the last provenance-backed release of each and treat these specific versions as compromised.

The dropper dependency:

We pulled and inspected the published tarballs without installing them. Every affected Mastra package shows the same single change: a new line in package.json declaring " easy-day-js": "^1.11.21 ". In the packages we examined, the dependency is not imported or referenced anywhere in the package source. It does no work for the library. Its only function is to be resolved and installed, which is enough to fire the dropper's postinstall hook.

This is why the Mastra packages themselves are not malicious in the usual sense. They are carriers. The malware is one dependency level down, and the lockfile constraint ^1.11.21 resolves to the weaponized 1.11.22 .

Every release also dropped the SLSA provenance attestation that the project's GitHub Actions pipeline normally produces, and several tripped a metadata masquerade check because the declared mastra-ai/mastra repository does not vouch for the published artifact. Both are consistent with a manual publish from outside the project's CI, using credentials with org-wide publish rights.

easy-day-js is built to pass a glance. It copies the dayjs description ("2KB immutable date time library alternative to Moment.js"), ships the real dayjs.min.js as its main entry, and includes the full dayjs locale and plugin tree. We confirmed the bundled dayjs.min.js is byte-identical between the decoy 1.11.21 and the weaponized 1.11.22. The only meaningful difference between the two versions is a single added file, setup.cjs , and a single added line in package.json :

setup.cjs is a 4.5 KB obfuscator.io-style script: a rotated string array behind a base64 decoder. We deobfuscated it statically in a sandbox, cracking the array rotation and resolving the string references. The operational literals are embedded directly in the install-time routine and are unambiguous. Reconstructed, it does the following:

The sequence is deliberate. Disabling NODE_TLS_REJECT_UNAUTHORIZED lets the dropper talk to a bare IP on port 8000 with no valid certificate. The payload is never written to disk in the package itself, only fetched at install time, so the published artifact stays small and clean-looking. detached: true plus . unref() means the spawned process keeps running after npm install returns, and windowsHide : true keeps it off-screen on Windows. The finally block removes setup.cjs so a post-install inspection of node_modules finds nothing.

The deobfuscated strings surfaced a second endpoint on the same host range, 23.254.164.123:443, alongside the primary 23.254.164.92:8000. Both should be blocked. The dropper also leaves two marker files, . pkg_history (containing the install path) and .pkg_logs , which are useful for hunting. As of time of analysis, the initial /update/49890878 payload was no longer reachable and returned a not found from the webserver.

All 32 Mastra versions in the table above, plus:

Pin every Mastra dependency to the last version published via GitHub Actions with provenance, and add easy-day-js to your registry blocklist.

Treat the host as compromised. The dropper disabled TLS validation in-process and launched a detached child whose contents were fetched at runtime, so the install hook is not the whole story.

When you're ready to take the step in securing your software supply chain, here are 3 ways Endor Labs can help: