Poisoned Pipeline / Incidents / AS70
@mastra scope poisoned via typosquat easy-day-js
npmAI coding agentsGit / GitHubLinux distro / packagesmacOS softwareDeveloper workstation
Between 01:12 and 02:36 UTC on 17 June 2026 an attacker republished more
than 140 packages in the @mastra npm scope (@mastra/core ~918k weekly
downloads, mastra, create-mastra) after taking a dormant maintainer
account. Package source was untouched; each manifest gained one new
dependency, the dayjs typosquat easy-day-js. That package’s setup.cjs
postinstall pulled a second-stage backdoor (Windows/macOS/Linux) that
stole browser history and data from 166 crypto-wallet and security
extensions (password managers, MFA, Zapier) and used a DGA fallback C2.
Same playbook as the March 2026 axios compromise (AS22). OpenSourceMalware
analysis.
Mapped techniques
- T0113 Compromised user account
- T0121 Compromised legitimate artifact
- T0129 Typosquatting
- T0151 Installation scripts
- T0172 Runtime backdoor
- T0184 Harvesting sensitive information from files
supply-chain transitive typosquat
Dormant @mastra maintainer account taken over.
140+ @mastra packages republished with one extra dependency.
easy-day-js clone of dayjs injected as a transitive dep.
setup.cjs postinstall self-deleting downloader.
Cross-platform second stage with DGA C2.
166 wallet, password-manager, MFA, and Zapier extension stores.