Mastra NPM Supply Chain Attack: 140 Packages Backdoor via easy-day-JS Typosquat
A typosquatted NPM dependency called "easy-day-js" was used to backdoor 140 packages in the Mastra ecosystem, including the main "mastra" package. The malicious versions exfiltrated system data and were disguised to mimic the legitimate "easy-dates-js" library.
Background
- **Mastra** is an open-source AI framework for building AI agents and workflows in JavaScript/TypeScript. Its npm packages let developers add AI features to projects.
- **What happened**: An attacker published a typosquat package (`@daylintes/easy-day-js`), mimicking a real date library. That fake package was then pulled in as a dependency by 140 legitimate Mastra npm packages, injecting a backdoor into any project that installed them.
- **Typosquatting**: A supply-chain tactic where malicious packages use names nearly identical to popular ones, tricking developers into installing the wrong package.
- **Why it matters**: This is a supply-chain attack — a single compromised dependency can infect thousands of downstream projects. The backdoor could exfiltrate secrets, env vars, or credentials from AI apps and production systems using Mastra.
- **Response**: The malicious package has been removed from npm; Mastra released patched versions. Users should rotate any secrets or keys exposed on affected systems.