Back Aikido.Dev

Over 140 popular Mastra npm Packages Hit by Supply Chain Attack

Aikido.Dev • June 17, 2026

On June 17th we detected a large-scale supply chain attack targeting the entire @mastra npm scope, a popular open-source AI agent framework. An attacker republished 141 packages in a burst between 01:15 and 02:00 UTC, silently injecting a malicious dependency into every one of them. The affected packages include @mastra/core , which has 918K weekly npm downloads, as well as mastra and create-mastra .

All 141 packages had a single new dependency added to their package.json : easy-day-js , a malicious clone of the popular date library dayjs . The package was published by a separate attacker-controlled account a day before the scope takeover. Crucially, the initial release (1.11.21) was completely clean, a straight copy of dayjs with no install hooks. The malicious version (1.11.22) followed the day, right around the time the @mastra packages were republished. The compromised packages depend on ^1.11.21 , but npm's caret resolution automatically pulls in the malicious 1.11.22 as the latest version, while auditing the pinned version reveals nothing suspicious.

Version 1.11.22 adds a postinstall hook that runs setup.cjs , an obfuscated script that executes automatically at install time without any user interaction.

What this script does, step by step:

The second stage runs as a long-lived background process that collects system information and targets over 160 browser-based crypto wallet extensions, including MetaMask, Keplr, Coinbase, and more. It establishes persistence by disguising itself as node-related tools on macOS, Windows, and Linux, all phoning to 23[.]254[.]164[.]123:443 .

The playbook here is nearly identical to the axios compromise we covered in March 2026. In both attacks, the attacker avoided touching the target package's own code and instead injected a malicious dependency, relying on npm's postinstall hook to execute the payload automatically at install time. Both staged a clean decoy version first, then followed with the malicious one. In the axios attack, plain-crypto-js played the role that easy-day-js plays here. Both droppers also self-delete after execution to remove forensic evidence.

The infrastructure also follows the same pattern. The axios dropper called back to a Hostwinds VPS on port 8000. The easy-day-js dropper does the same, hitting 23[.]254[.]164[.]92:8000 on Hostwinds infrastructure.

If you are an Aikido user, check your central feed and filter on malware issues. This will surface as a 100/100 critical issue. Aikido rescans nightly, but we recommend triggering a manual rescan now.

If you are not yet an Aikido user, you can create an account and connect your repos. Our malware coverage is included in the free plan, no credit card required.

For broader coverage across your whole team, Aikido's Device Protection gives you visibility and control over the software packages installed on your team's devices. It covers browser extensions, code libraries, IDE plugins, and build dependencies, all in one place. Stop malware before it gets installed.

For future protection, consider Aikido Safe Chain (open source). Safe Chain sits in your existing workflow, intercepting npm, npx, yarn, pnpm, and pnpx commands and checking packages against Aikido Intel before install.

23[.]254[.]164[.]92:8000 — first-stage C2, payload download 23[.]254[.]164[.]123:443 — second-stage callback host, passed to the spawned RAT

Secure your code, cloud, and runtime in one central system. Find and fix vulnerabilities fast automatically.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Mini Shai-Hulud Supply Chain Attack Targets SAP npm Packages A new supply chain attack, dubbed 'Mini Shai-Hulud', has compromised multiple npm packages related to SAP's Cloud Application Programming Model (CAP). This attack involves injecting malicious preinstall scripts into legitimate packages, which execute during installation to steal sensitive credentials from developers and CI/CD environments. The malware collects data such as GitHub tokens, npm credentials, and cloud secrets, exfiltrating them via public GitHub repositories. Researchers have linked this campaign to the TeamPCP threat actor group, known for similar tactics in previous attacks. At least four SAP-related npm packages have been confirmed as compromised, with the malicious payload being designed to propagate further across the npm ecosystem. The attack is ongoing, and organizations are advised to review their environments for affected packages and rotate any exposed secrets. 545 sources 71

Extracted Entities

Over 140 popular Mastra npm Packages Hit by Supply Chain Attack

The full story

Extracted Entities

Attack Types (1)

IP Addresses (1)

Malware (1)

MITRE ATT&CK (4)

Platforms (3)

Tools (1)