Mastra compromised in supply chain attack
The Mastra npm organization was compromised in a supply chain attack, with multiple packages trojanized to deliver a remote payload via the easy-day.js dependency. Attackers injected malicious code that downloads and executes a remote payload, putting downstream users at risk.
Background
- The article reports that the Mastra npm organization was compromised — attackers gained control of the Mastra account on npm (Node Package Manager, the standard package registry for JavaScript) and published trojanized versions of several Mastra open-source packages.
- Mastra is an AI framework: a toolkit for developers building AI-powered applications, distributed as open-source JavaScript packages.
- "Trojanized" means the packages were altered to contain hidden malware while still appearing legitimate. In this case, the malware delivered a remote payload (code that phones home to an attacker-controlled server).
- The attack exploited the "easy-day-js" dependency chain — malicious code was slipped into a small helper library that many larger projects indirectly depend on. This is a classic "supply chain" attack: instead of attacking a target directly, attackers poison a dependency that the target uses, infecting everything downstream.
- Supply chain attacks on npm are a growing security concern because a single compromised package can spread to thousands of applications.