144 Mastra npm Packages Compromised in Supply Chain Attack

A widespread software supply chain attack, identified as "easy-day-js," has resulted in the compromise of 144 npm packages associated with the Mastra namespace. The Mastra framework is a widely adopted open-source JavaScript and TypeScript solution utilized for developing artificial intelligence (AI) applications. This sophisticated attack was uncovered through the collaborative efforts of security researchers from JFrog, SafeDep, Socket, and StepSecurity. The core of the compromise involved a single npm account, "ehindero," which was used to mass-publish over 140 malicious packages within the Mastra scope in a very short timeframe on June 17, 2026. Interestingly, the initial versions of these packages did not contain malicious code directly. Instead, the attack vector was a third-party library named "easy-day-js," which was added as a dependency to each of the compromised Mastra packages. The "easy-day-js" JavaScript library was initially published by an npm user "sergey2016" on June 16, 2026, as a clean and fully functional component. However, malicious modifications were subsequently introduced to this library on June 17, 2026, at 1:01 a.m. UTC. This method of introducing malicious code through a seemingly benign, then later corrupted, dependency is a common tactic in modern supply chain attacks, making detection challenging. This incident serves as a stark reminder of the increasing vulnerabilities within the software supply chain, especially concerning open-source ecosystems like npm. Developers and organizations relying on such packages must implement robust security practices, including thorough vetting of dependencies, continuous monitoring for suspicious activity, and leveraging tools that can detect changes in upstream components. The rapid proliferation of AI applications further amplifies the potential impact of such attacks, as compromised AI frameworks could lead to widespread security flaws in numerous downstream applications. The incident underscores the critical need for improved security governance and proactive measures to safeguard the integrity of software components from development to deployment.