144 Mastra npm Packages Compromised via Hijacked Contributor Account

A software supply chain attack, dubbed ‘easy-day-js,’ compromised 144 npm packages within the Mastra namespace by hijacking a contributor account. The attack leveraged a malicious dependency, ‘easy-day-js,’ to deploy a cryptocurrency-stealing remote access trojan, highlighting vulnerabilities in open-source software supply chains. This incident underscores the importance of robust provenance and security practices within package management systems.