Executive Summary
144 @mastra npm packages for the Mastra AI app framework were compromised via a hijacked contributor account in the easy-day-js attack.
What Happened
As many as 144 npm packages associated with the Mastra namespace ("@mastra/*"), a popular open-source JavaScript and TypeScript framework for building artificial intelligence (AI) applications, have been compromised as part of a software supply chain attack codenamed easy-day-js, per findings from JFrog, SafeDep, Socket, and StepSecurity. "A single npm account (ehindero) mass-published more
Affected Products
- Mastra
- npm
Vulnerability / Attack Technique
AI framework package compromise
Technical Mechanism
Mass publishing from one hijacked account.
AI Security Category
LLM03:2025 Supply Chain
Part of the AI Supply Chain and AI SBOM topic.
Relevant Frameworks
RealGround Analysis
AI frameworks have large package surfaces. RealGround analysis: lockfiles limit exposure.
Recommended Controls
- Check lockfiles for affected Mastra versions
Related RealGround Service
AI Agent SBOM and LLM Mapping · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/06/144-mastra-npm-packages-compromised-via.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.