From package to postinstall payload: Inside the Mastra npm supply chain compromise

Attackers gained control of a legitimate npm maintainer account and injected malicious code into over 140 packages within the Mastra ecosystem, demonstrating how a single compromised identity can have cascading downstream effects. The attack leveraged a typosquat package ('easy-day-js') that disabled TLS verification and fetched a second-stage payload, meaning developers and CI/CD pipelines silently executed attacker-controlled code upon package installation. This matters because modern software development heavily trusts the open-source package ecosystem, and a compromised maintainer account bypasses most traditional security controls. The disabling of TLS verification is particularly dangerous as it opens the door to further man-in-the-middle attacks and credential theft on developer workstations.