Sign In

Supply Chain Attack Campaign

Ongoing

Mastra AI framework compromise

On June 17, 2026, an attacker compromised the @mastra npm organization and added easy-day-js, a typosquat of the popular dayjs date library as a ^1.11.21 dependency across @mastra packages in the Mastra AI framework ecosystem (combined more than a million weekly downloads). The attacker pre-positioned a clean version on June 16, and then on June 17 published the malicious version 1.11.22, which the floating version range automatically pulled at install time. That version added an obfuscated setup.cjs dropper executed via a postinstall hook. On install it disabled TLS verification, beaconed the install path to a temp file, downloaded a stage-2 payload, spawned it as a detached background process, then self-deleted to erase forensic traces, likely aiming to harvest the LLM API keys and cloud credentials common in Mastra environments.

Socket's AI scanner detected the malware in easy-day-js within six minutes after publication of the package, ensuring that Socket users were protected automatically, with installs of any of the compromised packages flagged and blocked.

Ecosystems: npm

First discovered
2026-06-17
Last activity
2026-06-17
Affected Package Artifacts
145
(145 unique packages)
Package Artifacts Last 7 Days
145
100%
vs previous 7 days

Blog Coverage

140+ Mastra npm Packages Compromised in Coordinated Supply Chain Attack

140+ Mastra npm Packages Compromised in Coordinated Supply Chain Attack

More than 140 Mastra npm packages were compromised in a supply chain attack that used a typosquatted dependency to deliver a cross-platform infostealer during installation.

By Socket Research Team  -  Jun 17, 2026

Affected packages

Package ArtifactPublishedDetected ▼

npm @mastra/node-speaker 0.1.1

2026-06-17 02:29:32 UTC2026-06-17 13:05:19 UTC
2026-06-17 01:50:12 UTC2026-06-17 07:07:25 UTC
2026-06-17 01:56:28 UTC2026-06-17 06:07:40 UTC
2026-06-17 02:36:20 UTC2026-06-17 06:07:40 UTC
2026-06-17 02:24:57 UTC2026-06-17 06:07:40 UTC
2026-06-17 02:26:57 UTC2026-06-17 06:07:40 UTC
2026-06-17 02:29:59 UTC2026-06-17 06:07:40 UTC
2026-06-17 01:40:55 UTC2026-06-17 06:07:40 UTC
2026-06-17 01:42:08 UTC2026-06-17 06:07:40 UTC
2026-06-17 02:28:00 UTC2026-06-17 06:07:40 UTC
2026-06-17 02:34:26 UTC2026-06-17 06:07:40 UTC
2026-06-17 02:35:54 UTC2026-06-17 06:07:40 UTC
2026-06-17 01:43:49 UTC2026-06-17 06:07:40 UTC
2026-06-17 01:51:03 UTC2026-06-17 06:07:40 UTC
2026-06-17 02:35:21 UTC2026-06-17 06:07:40 UTC
2026-06-17 01:51:57 UTC2026-06-17 06:07:40 UTC
2026-06-17 01:53:23 UTC2026-06-17 06:07:40 UTC
2026-06-17 02:33:57 UTC2026-06-17 06:07:39 UTC
2026-06-17 02:23:04 UTC2026-06-17 06:07:39 UTC
2026-06-17 02:01:34 UTC2026-06-17 06:07:39 UTC
2026-06-17 02:25:20 UTC2026-06-17 06:07:39 UTC
2026-06-17 01:58:45 UTC2026-06-17 06:07:39 UTC
2026-06-17 01:43:23 UTC2026-06-17 06:07:39 UTC
2026-06-17 02:16:23 UTC2026-06-17 06:07:39 UTC
2026-06-17 01:52:18 UTC2026-06-17 06:07:39 UTC
2026-06-17 01:53:00 UTC2026-06-17 06:07:39 UTC
2026-06-17 01:45:26 UTC2026-06-17 06:07:39 UTC
2026-06-17 01:40:23 UTC2026-06-17 06:07:39 UTC
2026-06-17 02:31:34 UTC2026-06-17 06:07:39 UTC
2026-06-17 02:33:09 UTC2026-06-17 06:07:39 UTC
2026-06-17 02:30:41 UTC2026-06-17 06:07:39 UTC
2026-06-17 02:31:56 UTC2026-06-17 06:07:39 UTC
2026-06-17 02:31:12 UTC2026-06-17 06:07:39 UTC
2026-06-17 02:32:39 UTC2026-06-17 06:07:39 UTC
2026-06-17 02:33:30 UTC2026-06-17 06:07:39 UTC
2026-06-17 02:32:20 UTC2026-06-17 06:07:38 UTC
2026-06-17 02:22:31 UTC2026-06-17 06:07:38 UTC
2026-06-17 02:19:47 UTC2026-06-17 06:07:38 UTC
2026-06-17 01:17:32 UTC2026-06-17 06:07:38 UTC
2026-06-17 02:03:37 UTC2026-06-17 06:07:35 UTC
2026-06-17 01:48:07 UTC2026-06-17 06:07:35 UTC
2026-06-17 01:42:56 UTC2026-06-17 06:07:35 UTC
2026-06-17 02:27:26 UTC2026-06-17 06:07:35 UTC
2026-06-17 01:46:54 UTC2026-06-17 06:07:35 UTC
2026-06-17 01:49:47 UTC2026-06-17 06:07:35 UTC
2026-06-17 01:52:40 UTC2026-06-17 06:07:34 UTC
2026-06-17 02:24:27 UTC2026-06-17 06:07:34 UTC
2026-06-17 01:28:15 UTC2026-06-17 06:07:34 UTC
2026-06-17 02:04:28 UTC2026-06-17 06:07:34 UTC
2026-06-17 02:17:42 UTC2026-06-17 06:07:34 UTC
2026-06-17 02:05:56 UTC2026-06-17 06:07:34 UTC
2026-06-17 01:18:59 UTC2026-06-17 06:07:34 UTC
2026-06-17 02:26:04 UTC2026-06-17 06:07:34 UTC
2026-06-17 01:51:32 UTC2026-06-17 06:07:34 UTC
2026-06-17 02:21:40 UTC2026-06-17 06:07:34 UTC
2026-06-17 01:56:57 UTC2026-06-17 06:07:34 UTC
2026-06-17 02:25:42 UTC2026-06-17 06:07:34 UTC
2026-06-17 01:16:15 UTC2026-06-17 06:07:34 UTC
2026-06-17 02:28:27 UTC2026-06-17 06:07:34 UTC
2026-06-17 02:00:55 UTC2026-06-17 06:07:34 UTC
2026-06-17 01:54:39 UTC2026-06-17 06:07:34 UTC
2026-06-17 01:18:14 UTC2026-06-17 06:07:34 UTC
2026-06-17 02:04:56 UTC2026-06-17 06:07:34 UTC
2026-06-17 02:09:19 UTC2026-06-17 06:07:34 UTC
2026-06-17 02:00:19 UTC2026-06-17 06:07:34 UTC
2026-06-17 02:21:13 UTC2026-06-17 06:07:34 UTC
2026-06-17 02:03:10 UTC2026-06-17 06:07:34 UTC
2026-06-17 02:07:15 UTC2026-06-17 06:07:34 UTC
2026-06-17 01:48:36 UTC2026-06-17 06:07:33 UTC
2026-06-17 02:06:22 UTC2026-06-17 06:07:33 UTC
2026-06-17 01:31:19 UTC2026-06-17 06:07:33 UTC
2026-06-17 02:26:27 UTC2026-06-17 06:07:33 UTC
2026-06-17 02:20:39 UTC2026-06-17 06:07:33 UTC
2026-06-17 01:44:12 UTC2026-06-17 06:07:33 UTC
2026-06-17 01:57:45 UTC2026-06-17 06:07:33 UTC
2026-06-17 01:53:44 UTC2026-06-17 06:07:33 UTC
2026-06-17 01:41:44 UTC2026-06-17 06:07:33 UTC
2026-06-17 02:02:40 UTC2026-06-17 06:07:33 UTC
2026-06-17 01:47:44 UTC2026-06-17 06:07:33 UTC
2026-06-17 02:05:28 UTC2026-06-17 06:07:33 UTC
2026-06-17 01:19:51 UTC2026-06-17 06:07:33 UTC
2026-06-17 01:41:19 UTC2026-06-17 06:07:33 UTC
2026-06-17 02:34:52 UTC2026-06-17 06:07:33 UTC
2026-06-17 02:04:01 UTC2026-06-17 06:07:33 UTC
2026-06-17 01:58:13 UTC2026-06-17 06:07:33 UTC
2026-06-17 01:15:13 UTC2026-06-17 06:07:33 UTC
2026-06-17 01:46:13 UTC2026-06-17 06:07:33 UTC
2026-06-17 02:23:58 UTC2026-06-17 06:07:33 UTC
2026-06-17 01:50:38 UTC2026-06-17 06:07:33 UTC
2026-06-17 01:55:07 UTC2026-06-17 06:07:33 UTC
2026-06-17 02:30:20 UTC2026-06-17 06:07:32 UTC
2026-06-17 01:26:24 UTC2026-06-17 06:07:32 UTC
2026-06-17 02:02:09 UTC2026-06-17 06:07:32 UTC
2026-06-17 01:45:05 UTC2026-06-17 06:07:32 UTC
2026-06-17 02:15:40 UTC2026-06-17 06:07:32 UTC
2026-06-17 02:28:55 UTC2026-06-17 06:07:32 UTC
2026-06-17 02:19:15 UTC2026-06-17 06:07:32 UTC
2026-06-17 01:57:20 UTC2026-06-17 06:07:32 UTC
2026-06-17 02:18:10 UTC2026-06-17 06:07:32 UTC
2026-06-17 01:55:53 UTC2026-06-17 06:07:32 UTC
2026-06-17 01:47:16 UTC2026-06-17 06:07:32 UTC
2026-06-17 02:16:48 UTC2026-06-17 06:07:32 UTC
2026-06-17 02:18:44 UTC2026-06-17 06:07:31 UTC
2026-06-17 02:20:13 UTC2026-06-17 06:07:31 UTC
2026-06-17 02:08:45 UTC2026-06-17 06:07:31 UTC
2026-06-17 01:46:33 UTC2026-06-17 06:07:31 UTC
2026-06-17 01:45:48 UTC2026-06-17 06:07:31 UTC
2026-06-17 01:54:11 UTC2026-06-17 06:07:31 UTC
2026-06-17 02:06:47 UTC2026-06-17 06:07:31 UTC
2026-06-17 02:22:03 UTC2026-06-17 06:07:31 UTC
2026-06-17 01:44:36 UTC2026-06-17 06:07:31 UTC
2026-06-17 02:17:14 UTC2026-06-17 06:07:31 UTC
2026-06-17 02:23:27 UTC2026-06-17 06:07:31 UTC
2026-06-17 01:59:24 UTC2026-06-17 06:07:31 UTC
2026-06-17 01:42:27 UTC2026-06-17 06:07:31 UTC
2026-06-17 01:55:31 UTC2026-06-17 06:07:31 UTC
2026-06-17 01:26:53 UTC2026-06-17 04:02:35 UTC
2026-06-17 01:34:46 UTC2026-06-17 04:02:33 UTC
2026-06-17 01:39:59 UTC2026-06-17 04:02:31 UTC
2026-06-17 01:29:49 UTC2026-06-17 04:02:29 UTC
2026-06-17 01:37:01 UTC2026-06-17 04:02:27 UTC
2026-06-17 01:25:36 UTC2026-06-17 04:02:25 UTC
2026-06-17 01:35:39 UTC2026-06-17 04:02:23 UTC
2026-06-17 01:33:33 UTC2026-06-17 04:02:21 UTC
2026-06-17 01:25:04 UTC2026-06-17 04:02:19 UTC
2026-06-17 01:36:07 UTC2026-06-17 04:02:16 UTC
2026-06-17 01:30:42 UTC2026-06-17 04:02:14 UTC
2026-06-17 01:38:11 UTC2026-06-17 04:02:12 UTC
2026-06-17 01:35:10 UTC2026-06-17 04:02:10 UTC
2026-06-17 01:12:43 UTC2026-06-17 04:02:08 UTC
2026-06-17 01:20:37 UTC2026-06-17 04:02:06 UTC
2026-06-17 01:32:07 UTC2026-06-17 04:02:04 UTC
2026-06-17 01:27:27 UTC2026-06-17 04:02:02 UTC
2026-06-17 01:38:36 UTC2026-06-17 04:01:59 UTC
2026-06-17 01:33:06 UTC2026-06-17 04:01:57 UTC
2026-06-17 01:37:42 UTC2026-06-17 04:01:55 UTC
2026-06-17 01:30:13 UTC2026-06-17 04:01:53 UTC
2026-06-17 01:31:43 UTC2026-06-17 04:01:51 UTC
2026-06-17 01:29:15 UTC2026-06-17 04:01:49 UTC
2026-06-17 01:34:13 UTC2026-06-17 04:01:47 UTC
2026-06-17 01:39:37 UTC2026-06-17 04:01:45 UTC
2026-06-17 01:39:14 UTC2026-06-17 04:01:43 UTC
2026-06-17 01:32:34 UTC2026-06-17 04:01:40 UTC
2026-06-17 01:01:33 UTC2026-06-17 01:07:43 UTC
2026-06-16 14:58:45 UTC2026-06-16 21:05:18 UTC

Showing 145 of 145

Socket for GitHub

Socket Firewall

Socket CLI

Socket Certified Patches

Socket Web Extension

Socket Optimize

Socket Dependency Search

Socket Reachability

Languages

JavaScript / TypeScript
Python
Go
Ruby
All Languages

Integrations

All Integrations
Source Control
Ticketing & Messaging
Package Managers
SIEM

Resources

Docs
Changelog
Package Alerts
FAQ
Glossary

Company

About
Careers
Investors
Security
Love

News

Security
Company
Engineering
Application Security
View All

Achievements

SOC 2 Type 2
Raised $125M
Fortune Cyber 60
Top Customers
Company News

Stay in touch

Get open source security insights delivered straight into your inbox.

Book a DemoSign In
TermsPrivacySecurity

Made with ⚡️ by Socket Inc

U.S. Patent No. 12,346,443 & 12,314,394. Other pending.

SOC 2 Type II certified