Account takeover led to the spreading multi-stage dropper containing a crypto-stealer logic. 141 packages affected, with an estimated over ~8M weekly downloads

Breaking News: The @mastra organization in npm was hit with a supply chain attack, 141 packages affected, with an estimated over ~8M weekly downloads, and 29M monthly downloads

Overview

On June 17, 2026, the npm account “ehindero” was hijacked to deliver malware targeting the @mastra organization on npm. The malicious code wasn’t injected directly into the affected packages — instead, the attacker used a subtler approach: they swapped one of the dependencies, “dayjs,” for an attacker-controlled package called “easy-day-js.” The first version of “easy-day-js” was clean, but a subsequent version introduced crypto-stealing logic inside a post-install script.

The attack was coordinated by the threat actor stealing the “ehindero” account, and another account – “sergey2016” – uploading the malicious npm package, and weaponizing it.

The use of install script is soon to be deprecated in npm, which might surge an increase in the amount of pre & post install script malware until the estimated release of npm v12 in July.

Who is affected

Anyone who installed a @mastra organization package during the malware uptime in June 17 2026.

Impact

Total accumulated monthly downloads – ~29,230,561
Total affected packages – 141 (see table chart below)
Total accumulated weekly downloads – ~8,031,590

Recommended Actions

Immediate Actions:

Harden access to your crypto-wallets and check for unknown transactions
Downgrade the affected packages to a safe version

Technical Analysis

We will start our analysis with the first stage-1 dropper, which is delivered via a malicious npm package named easy-day-js.
This is a typesquat of the legitimate and widely-used [day.js](https://github.com/iamkun/dayjs) date library – which has over 40M+ weekly downloads on npm.

The package.json file is cloned almost entirely from the real [day.js](http://day.js) package (same author, description, homepage, repository URL) with two changes we will mention:
The name field changed from dayjs to easy-day-js.
A postinstall lifecycle hook added: ”postinstall”: “node setup.cjs –no-warnings”

The threat actor changed the “dayjs” dependency in the @mastra packages to “easy-day-js”, which contained the malicious dropper.

This causes setup.cjs to execute automatically and silently on every npm install.

First of all, the malware makes the TLS verification disabled:

This disables SSL/TLS certificate validation for the entire process, allowing communication with attacker servers using self-signed certificates.

Next, we found the hardcoded C2 addresses:

Two distinct attacker IPs with specific roles:

23.254[.]164.92:8000 – the payload delivery server.
23.254[.]164.123:443 – C2 server, passed as argument to stage 2.

In the next step, the package name is encoded as: ASCII value + 128 and then decoded into: easy-day-js – the package name itself, obfuscated and embedded in the dropper.

Then, we move on to Stage 2 of payload fetch and execution:

This snippet of code contains several steps:
Fetch – downloads stage-2 JS payload from the C2 as plain text.
Random filename – crypto.randomBytes(12).toString(“hex”) + “.js” generates a 24-character random hex filename (e.g. [a3f9c12d4b8e7f2a1c9d3e4f.js](http://a3f9c12d4b8e7f2a1c9d3e4f.js)). Static filename detection won’t work against this.
Write to temp – payload lands in the OS temp directory, not the package directory making it harder to correlate with the npm install.
C2 address as argument – 23.254.164.123:443 is passed as process.argv[2] to stage 2 which uses it to communicate with the C2 server.

At the final part, there is a self-deletion step which works as anti-forensics:

This removes the primary forensic artifact. Post-incident, there is no dropper on disk –
only the randomly-named stage-2 script in the temp directory (itself likely self-deleting).

Conclusions

npm’s upcoming deprecation of pre/post install scripts in v12 is a meaningful step — but threat actors are already adapting. As this attack shows, malicious logic can be embedded in alternative hooks like binding.gyp, sidestepping the restriction entirely.

Beyond install-time controls, the deeper gap remains: npm has no meaningful review process for packages uploaded with malicious intent. That leaves import-time attacks, typosquatting, and dependency hijacking largely unaddressed — regardless of what v12 ships.

Hardened 2FA and install script restrictions raise the cost of attack. They don’t close the window..

Affected Packages

Package name

Affected versions

@mastra/acp

0.2.2

@mastra/agent-browser

0.3.2

@mastra/agent-builder

1.0.42

@mastra/agentcore

0.2.2

@mastra/agentfs

0.1.1

@mastra/ai-sdk

1.4.6

@mastra/arize

1.2.3

@mastra/arthur

0.3.3

@mastra/astra

1.0.2

@mastra/auth

1.0.3

@mastra/auth-auth0

1.0.2

@mastra/auth-better-auth

1.0.4

@mastra/auth-clerk

1.0.3

@mastra/auth-cloud

1.1.4

@mastra/auth-firebase

1.0.1

@mastra/auth-okta

0.0.5

@mastra/auth-studio

1.2.4

@mastra/auth-supabase

1.0.2

@mastra/auth-workos

1.5.3

@mastra/azure

0.2.3

@mastra/blaxel

0.4.2

@mastra/braintrust

1.1.4

@mastra/brightdata

0.2.2

@mastra/browser-firecrawl

0.1.1

@mastra/browser-viewer

0.1.3

@mastra/chroma

1.0.2

@mastra/clickhouse

1.10.1

@mastra/claude

1.0.3

@mastra/client-js

1.24.1

@mastra/cloud

0.1.24

@mastra/cloudflare

1.4.2

@mastra/cloudflare-d1

1.0.7

@mastra/codemod

1.0.4

@mastra/convex

1.2.2

@mastra/core

1.42.1

@mastra/couchbase

1.0.4

@mastra/cursor

0.2.1

@mastra/dane

1.0.2

@mastra/datadog

1.2.5

@mastra/daytona

0.4.2

@mastra/deployer

1.42.1

@mastra/deployer-cloud

1.42.1

@mastra/deployer-cloudflare

1.1.44

@mastra/deployer-netlify

1.1.20

@mastra/deployer-vercel

1.1.38

@mastra/docker

0.3.1

@mastra/dsql

1.0.3

@mastra/duckdb

1.4.3

@mastra/dynamodb

1.0.9

@mastra/e2b

0.3.4

@mastra/editor

0.11.3

@mastra/elasticsearch

1.2.1

@mastra/engine

0.1.1

@mastra/evals

1.3.1

@mastra/express

1.3.31

@mastra/fastembed

1.1.3

@mastra/fastify

1.3.31

@mastra/files-sdk

0.2.1

@mastra/gcs

0.2.3

@mastra/github-signals

0.1.2

@mastra/google-cloud-pubsub

1.0.6

@mastra/google-drive

0.1.1

@mastra/hono

1.4.26

@mastra/inngest

1.5.2

@mastra/koa

1.5.14

@mastra/laminar

1.2.3

@mastra/lance

1.0.7

@mastra/langfuse

1.3.6

@mastra/langsmith

1.2.4

@mastra/libsql

1.13.1

@mastra/loggers

1.1.3

@mastra/longmemeval

1.0.50

@mastra/mcp

1.10.1

@mastra/mcp-docs-server

1.1.47

@mastra/mcp-registry-registry

1.0.2

@mastra/mem0

0.1.14

@mastra/memory

1.20.4

@mastra/modal

0.2.2

@mastra/mongodb

1.9.3

@mastra/mssql

1.3.2

@mastra/mysql

0.1.1

@mastra/nestjs

0.1.15

@mastra/node-audio

0.1.8

@mastra/observability

1.14.2

@mastra/openai

1.0.2

@mastra/opencode

0.0.47

@mastra/opensearch

1.0.3

@mastra/otel-bridge

1.2.3

@mastra/otel-exporter

1.2.3

@mastra/perplexity

0.1.1

@mastra/pg

1.13.1

@mastra/pinecone

1.0.2

@mastra/playground-ui

33.0.1

@mastra/posthog

1.0.29

@mastra/qdrant

1.0.3

@mastra/rag

2.2.2

@mastra/railway

0.1.1

@mastra/react

1.0.1

@mastra/redis

1.1.3

@mastra/redis-streams

0.0.4

@mastra/s3

0.5.3

@mastra/schema-compat

1.2.12

@mastra/sentry

1.1.4

@mastra/server

2.1.1

@mastra/slack

1.3.1

@mastra/spanner

1.1.2

@mastra/speech-azure

0.2.1

@mastra/speech-elevenlabs

0.2.1

@mastra/speech-google

0.2.1

@mastra/speech-ibm

0.2.1

@mastra/speech-murf

0.2.1

@mastra/speech-openai

0.2.1

@mastra/speech-replicate

0.2.1

@mastra/speech-speechify

0.2.1

@mastra/stagehand

0.2.5

@mastra/tavily

1.0.3

@mastra/temporal

0.1.14

@mastra/turbopuffer

1.0.3

@mastra/twilio

1.0.2

@mastra/upstash

1.1.3

@mastra/vectorize

1.0.3

@mastra/vercel

1.0.1

@mastra/voice-aws-nova-sonic

0.1.4

@mastra/voice-azure

0.11.2

@mastra/voice-cloudflare

0.12.3

@mastra/voice-deepgram

0.12.2

@mastra/voice-elevenlabs

0.12.2

@mastra/voice-gladia

0.12.2

@mastra/voice-google

0.12.3

@mastra/voice-google-gemini-live

0.12.2

@mastra/voice-inworld

0.3.1

@mastra/voice-modelslab

0.1.2

@mastra/voice-murf

0.12.3

@mastra/voice-openai

0.12.3

@mastra/voice-openai-realtime

0.12.6

@mastra/voice-playai

0.12.2

@mastra/voice-sarvam

1.0.2

@mastra/voice-speechify

0.12.2

@mastra/voice-xai-realtime

0.1.2

create-mastra

1.13.1

easy-day-js

1.11.22

mastra

1.13.1

How Can OX Help?

If you’re an OX customer, inside the OX platform, go to the Active Issues view, under the ‘Severity’ category, you can filter by ‘Malicious Dependency’ to instantly find threats across both your repositories and containerized environments.

If you don’t have an account, you can sign up for a demo to see how OX detects these threats in your environment.

The post easy-day-js Supply Chain Attack Hits Mastra AI in npm appeared first on OX Security.