Mastra npm scope hijacked: 144 AI-framework packages backdoored (easy-day-js)

On 17 June 2026, the @mastra npm scope — the package namespace of Mastra, a widely used open-source TypeScript framework for building AI agents and AI-powered applications maintained by San Francisco startup Kepler Software (founded by the team behind Gatsby) — was hijacked in a software supply-chain attack tracked as easy-day-js. An attacker used a forgotten, still-privileged contributor account to republish 144 packages under the scope, each carrying a single malicious dependency that delivered a remote-access trojan and cryptocurrency stealer to anyone who installed them.

How it happened

The campaign hinged on two things: a typosquatted package and a dormant account with publishing rights. On 16 June 2026, an npm user called sergey2016 published easy-day-js, a near-copy of the popular dayjs library, as clean code. Early on 17 June (around 01:01 UTC) that package was quietly updated with malicious logic. Minutes later, between roughly 01:12 and 02:39 UTC, the attacker abused a hijacked @mastra contributor account (ehindero) whose publishing access to the scope had never been revoked, running an automated 88-minute campaign that republished 142 packages across the namespace — each with easy-day-js added to its dependency list.

The payload

Pulling in easy-day-js triggered the download and execution of a cross-platform remote-access trojan with cryptocurrency-stealing functionality. Because the malicious dependency rode inside trusted @mastra/* packages — which together see more than 1.1 million weekly downloads — any developer workstation, CI runner, or build system that installed an affected version after 16 June 2026 should be treated as potentially compromised.

Why it matters

The incident is a textbook supply-chain failure: a single over-privileged, forgotten contributor account was enough to weaponise an entire popular namespace, and a typosquatted transitive dependency hid the payload in plain sight. Responders and GitHub urged developers to roll back to pre-incident package versions and rotate every secret that may have been exposed on affected machines — npm and GitHub tokens, cloud-provider keys, LLM API keys, CI/CD secrets, SSH keys, and database credentials — and to move any cryptocurrency funds to fresh wallets generated on clean devices. It is also a pointed reminder that the booming AI-tooling ecosystem is now squarely in the sights of supply-chain attackers.