144 Mastra npm Packages Compromised via Hijacked Contributor Account

Summary

As many as 144 npm packages associated with the Mastra namespace ("@mastra/*"), a popular open-source JavaScript and TypeScript framework for building artificial intelligence (AI) applications, have been compromised as part of a software supply chain attack codenamed easy-day-js, per findings from Endor Labs, JFrog, SafeDep, Socket, and StepSecurity. "A single npm account (ehindero)

Lotu Radar provides attributed news summaries and links to the original publisher. Full reporting and copyright remain with the source.