[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvl9jaLhX971MXR84KSCZODVW58OilY0-3-Qiej3BTxI":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"9d090aa8-8ab8-4641-a1fa-e535d043f804","hijacked-npm-contributor-account-poisons-144-mastra-packages","953280bf-30f3-40d3-bac8-1126d5903809","Hijacked npm Contributor Account Poisons 144 Mastra Packages","Attackers compromised a contributor's npm account to publish malicious versions of the 'easy-day-js' library, which was then used as a dropper to deliver a cryptocurrency-stealing infostealer across 144 packages in the Mastra namespace. The root issue is a combination of weak account security on a trusted contributor account and insufficient integrity verification for third-party dependencies. This attack demonstrates how a single compromised identity in a package ecosystem can cascade into a widespread supply chain compromise affecting all downstream consumers. It matters because developers and organizations trusting these packages unknowingly execute malicious code, potentially exposing wallets, credentials, and sensitive data.","**Immediate actions:**\n- Audit all dependencies in your projects for the compromised 'easy-day-js' package and remove or pin to a known-good version immediately.\n- Enforce multi-factor authentication (MFA) on all npm contributor and maintainer accounts to prevent account hijacking.\n- Run a software composition analysis (SCA) scan across your codebase to identify any exposure to the affected Mastra namespace packages.\n\n**Long-term improvements:**\n- Implement a dependency review and approval process that verifies package integrity (e.g., checksums, provenance attestation) before any new or updated dependency is introduced.\n- Adopt a private package registry or mirror to control which versions of open-source packages are permitted within your environment.\n- Apply the principle of least privilege to package publishing rights, ensuring only designated maintainers can publish to critical namespaces.\n\n**Detection measures:**\n- Monitor npm audit logs and dependency manifests for unexpected version changes or newly introduced packages using automated SCA tooling in CI\u002FCD pipelines.\n- Set up runtime behavioral monitoring to detect anomalous outbound network connections or unexpected process execution that may indicate infostealer activity.\n- Subscribe to security advisories from npm, OSV, and relevant threat intelligence feeds to receive early warnings about compromised packages.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 5: Account Management","CIS Control 16: Application Software Security","NIST SP 800-161: Supply Chain Risk Management","NIST AC-2: Account Management","NIST IA-5: Authenticator Management (MFA)","NIST SR-11: Component Authenticity","SLSA Framework: Supply-chain Levels for Software Artifacts","SSDF (NIST SP 800-218): Secure Software Development Framework","GDPR Article 32: Security of Processing (for organizations handling EU personal data)",{},"published","2026-06-17T08:21:44.592794+00:00","2026-06-17T08:21:44.506+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002F144-mastra-npm-packages-compromised-via.html","144-mastra-npm-packages-compromised-via-hijacked-contributor-account-44495b","144 Mastra npm Packages Compromised via Hijacked Contributor Account",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":38,"name":39,"slug":40,"description":41,"color":42},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":44,"name":45,"slug":46,"description":47,"color":48},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[51,55,59],{"slug":52,"name":53,"problem":54},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":56,"name":57,"problem":58},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",{"slug":60,"name":61,"problem":62},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]