
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.

Mastra is the Typescript framework for building AI agents and assistants. It’s used by some of the largest companies in the world to build internal AI automation tooling and customer-facing agents.
This is the CLI package, which allows you to:
npm i -g mastra
mastra init is used for initializing a new project.
This creates a mastra directory under src containing an index.ts entrypoint and an agent directory containing two sample agents.
project-root/
├── src/
├── app/
└── mastra/
├── agents/
│ └── agents.ts
└── index.ts
mastra dev
This spins up a local development server that hosts REST endpoints for all agents and workflows. It also has a chat interface for testing them.
The server is useful for testing and developing agents, workflows, and integrations without needing to deploy your application.
The server is available at http://localhost:3000.
mastra build
This command builds your Mastra project for deployment to different environments. The build process:
Options:
--dir Directory containing Mastra files (default: src/mastra)
Example usage:
# Build using default directory
mastra build
# Build from custom directory
mastra build --dir path/to/mastra
The build output is determined by your Mastra instance's deployer configuration:
const mastra = new Mastra({
deployer: {
type: 'HONO', // Target environment (HONO, EXPRESS, NEXT)
// Environment-specific options
},
});
mastra lint
Validates your Mastra project structure and code.
Options:
--root Path to your root folder
--tools Comma-separated list of paths to tool files to include
Example usage:
# Lint default directory
mastra lint
This CLI collects anonymous usage data (no personal/sensitive info) to help improve Mastra. This includes:
To opt-out:
MASTRA_TELEMETRY_DISABLED=1 to commandspnpm i to install depsFAQs
cli for mastra
The npm package mastra receives a total of 46,076 weekly downloads. As such, mastra popularity was classified as popular.
We found that mastra demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 11 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.

Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.

Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.