The Weekly Dependency Threat Report: 2026-06-20

This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries.

1. @mastra/client-js (npm)

Package: https://www.npmjs.com/package/@mastra/client-js
Severity: critical
Affected versions: 1.24.1
Downloads: 250837
First seen: 17 June 2026 at 03:32 UTC

@mastra/client-js@1.24.1 was trojanized as part of a coordinated supply chain attack on the @mastra npm organization on 2026-06-17 between 01:12-02:24 UTC. A compromised maintainer account ('ehindero', ehindero2016@tutamail.com) published this version with an injected dependency on easy-day-js@^1.11.21, which resolved via semver to the weaponized easy-day-js@1.11.22. That package's postinstall hook (setup.cjs) executes a dropper that disables TLS, fetches a remote payload from C2 at 23.254.164.92:8000/update/49890878, writes it to a randomly named file, spawns a persistent detached process, and self-deletes. All 116 packages across the scope were hit in a 72-minute window. This release lacks SLSA provenance attestations, confirming out-of-band publication.

References: https://www.endorlabs.com/learn/mastra-npm-org-compromised-multiple-packages-trojanized-to-drop-a-remote-payload-via-easy-day-js, https://github.com/mastra-ai/mastra/issues/18044, https://www.npmjs.com/package/easy-day-js

2. @mastra/otel-exporter (npm)

Package: https://www.npmjs.com/package/@mastra/otel-exporter
Severity: critical
Affected versions: 1.2.3
Downloads: 209726
First seen: 17 June 2026 at 03:33 UTC

@mastra/otel-exporter@1.2.3 was trojanized as part of a coordinated supply chain attack on the @mastra npm organization on 2026-06-17 between 01:12-02:24 UTC. A compromised maintainer account ('ehindero', ehindero2016@tutamail.com) published this version with an injected dependency on easy-day-js@^1.11.21, which resolved via semver to the weaponized easy-day-js@1.11.22. That package's postinstall hook (setup.cjs) executes a dropper that disables TLS, fetches a remote payload from C2 at 23.254.164.92:8000/update/49890878, writes it to a randomly named file, spawns a persistent detached process, and self-deletes. All 116 packages across the scope were hit in a 72-minute window. This release lacks SLSA provenance attestations, confirming out-of-band publication.

3. @mastra/dynamodb (npm)

Package: https://www.npmjs.com/package/@mastra/dynamodb
Severity: critical
Affected versions: 1.0.9
Downloads: 160266
First seen: 17 June 2026 at 03:31 UTC

@mastra/dynamodb@1.0.9 was trojanized as part of a coordinated supply chain attack on the @mastra npm organization on 2026-06-17 between 01:12-02:24 UTC. A compromised maintainer account ('ehindero', ehindero2016@tutamail.com) published this version with an injected dependency on easy-day-js@^1.11.21, which resolved via semver to the weaponized easy-day-js@1.11.22. That package's postinstall hook (setup.cjs) executes a dropper that disables TLS, fetches a remote payload from C2 at 23.254.164.92:8000/update/49890878, writes it to a randomly named file, spawns a persistent detached process, and self-deletes. All 116 packages across the scope were hit in a 72-minute window. This release lacks SLSA provenance attestations, confirming out-of-band publication.

4. @mastra/hono (npm)

Package: https://www.npmjs.com/package/@mastra/hono
Severity: critical
Affected versions: 1.4.26
Downloads: 152792
First seen: 17 June 2026 at 03:31 UTC

@mastra/hono@1.4.26 was trojanized as part of a coordinated supply chain attack on the @mastra npm organization on 2026-06-17 between 01:12-02:24 UTC. A compromised maintainer account ('ehindero', ehindero2016@tutamail.com) published this version with an injected dependency on easy-day-js@^1.11.21, which resolved via semver to the weaponized easy-day-js@1.11.22. That package's postinstall hook (setup.cjs) executes a dropper that disables TLS, fetches a remote payload from C2 at 23.254.164.92:8000/update/49890878, writes it to a randomly named file, spawns a persistent detached process, and self-deletes. All 116 packages across the scope were hit in a 72-minute window. This release lacks SLSA provenance attestations, confirming out-of-band publication.

5. @mastra/otel-bridge (npm)

Package: https://www.npmjs.com/package/@mastra/otel-bridge
Severity: critical
Affected versions: 1.2.3
Downloads: 132788
First seen: 17 June 2026 at 03:31 UTC

@mastra/otel-bridge@1.2.3 was trojanized as part of a coordinated supply chain attack on the @mastra npm organization on 2026-06-17 between 01:12-02:24 UTC. A compromised maintainer account ('ehindero', ehindero2016@tutamail.com) published this version with an injected dependency on easy-day-js@^1.11.21, which resolved via semver to the weaponized easy-day-js@1.11.22. That package's postinstall hook (setup.cjs) executes a dropper that disables TLS, fetches a remote payload from C2 at 23.254.164.92:8000/update/49890878, writes it to a randomly named file, spawns a persistent detached process, and self-deletes. All 116 packages across the scope were hit in a 72-minute window. This release lacks SLSA provenance attestations, confirming out-of-band publication.

6. @mastra/editor (npm)

Package: https://www.npmjs.com/package/@mastra/editor
Severity: critical
Affected versions: 0.11.3
Downloads: 128885
First seen: 17 June 2026 at 03:31 UTC

@mastra/editor@0.11.3 was trojanized as part of a coordinated supply chain attack on the @mastra npm organization on 2026-06-17 between 01:12-02:24 UTC. A compromised maintainer account ('ehindero', ehindero2016@tutamail.com) published this version with an injected dependency on easy-day-js@^1.11.21, which resolved via semver to the weaponized easy-day-js@1.11.22. That package's postinstall hook (setup.cjs) executes a dropper that disables TLS, fetches a remote payload from C2 at 23.254.164.92:8000/update/49890878, writes it to a randomly named file, spawns a persistent detached process, and self-deletes. All 116 packages across the scope were hit in a 72-minute window. This release lacks SLSA provenance attestations, confirming out-of-band publication.

7. @mastra/langsmith (npm)

Package: https://www.npmjs.com/package/@mastra/langsmith
Severity: critical
Affected versions: 1.2.4
Downloads: 120459
First seen: 17 June 2026 at 03:31 UTC

@mastra/langsmith@1.2.4 was trojanized as part of a coordinated supply chain attack on the @mastra npm organization on 2026-06-17 between 01:12-02:24 UTC. A compromised maintainer account ('ehindero', ehindero2016@tutamail.com) published this version with an injected dependency on easy-day-js@^1.11.21, which resolved via semver to the weaponized easy-day-js@1.11.22. That package's postinstall hook (setup.cjs) executes a dropper that disables TLS, fetches a remote payload from C2 at 23.254.164.92:8000/update/49890878, writes it to a randomly named file, spawns a persistent detached process, and self-deletes. All 116 packages across the scope were hit in a 72-minute window. This release lacks SLSA provenance attestations, confirming out-of-band publication.

8. @mastra/mcp-docs-server (npm)

Package: https://www.npmjs.com/package/@mastra/mcp-docs-server
Severity: critical
Affected versions: 1.1.47
Downloads: 97609
First seen: 17 June 2026 at 03:31 UTC

@mastra/mcp-docs-server@1.1.47 was trojanized as part of a coordinated supply chain attack on the @mastra npm organization on 2026-06-17 between 01:12-02:24 UTC. A compromised maintainer account ('ehindero', ehindero2016@tutamail.com) published this version with an injected dependency on easy-day-js@^1.11.21, which resolved via semver to the weaponized easy-day-js@1.11.22. That package's postinstall hook (setup.cjs) executes a dropper that disables TLS, fetches a remote payload from C2 at 23.254.164.92:8000/update/49890878, writes it to a randomly named file, spawns a persistent detached process, and self-deletes. All 116 packages across the scope were hit in a 72-minute window. This release lacks SLSA provenance attestations, confirming out-of-band publication.

9. @mastra/mongodb (npm)

Package: https://www.npmjs.com/package/@mastra/mongodb
Severity: critical
Affected versions: 1.9.3
Downloads: 92100
First seen: 17 June 2026 at 03:31 UTC

@mastra/mongodb@1.9.3 was trojanized as part of a coordinated supply chain attack on the @mastra npm organization on 2026-06-17 between 01:12-02:24 UTC. A compromised maintainer account ('ehindero', ehindero2016@tutamail.com) published this version with an injected dependency on easy-day-js@^1.11.21, which resolved via semver to the weaponized easy-day-js@1.11.22. That package's postinstall hook (setup.cjs) executes a dropper that disables TLS, fetches a remote payload from C2 at 23.254.164.92:8000/update/49890878, writes it to a randomly named file, spawns a persistent detached process, and self-deletes. All 116 packages across the scope were hit in a 72-minute window. This release lacks SLSA provenance attestations, confirming out-of-band publication.

10. @mastra/posthog (npm)

Package: https://www.npmjs.com/package/@mastra/posthog
Severity: critical
Affected versions: 1.0.29
Downloads: 90917
First seen: 17 June 2026 at 03:31 UTC

@mastra/posthog@1.0.29 was trojanized as part of a coordinated supply chain attack on the @mastra npm organization on 2026-06-17 between 01:12-02:24 UTC. A compromised maintainer account ('ehindero', ehindero2016@tutamail.com) published this version with an injected dependency on easy-day-js@^1.11.21, which resolved via semver to the weaponized easy-day-js@1.11.22. That package's postinstall hook (setup.cjs) executes a dropper that disables TLS, fetches a remote payload from C2 at 23.254.164.92:8000/update/49890878, writes it to a randomly named file, spawns a persistent detached process, and self-deletes. All 116 packages across the scope were hit in a 72-minute window. This release lacks SLSA provenance attestations, confirming out-of-band publication.

Want help mitigating malicious packages before they reach your network?

ShieldedStack acts as a security proxy in front of npm, PyPI, NuGet, and Maven, helping teams detect and block malicious or risky packages before they reach developer machines or CI pipelines.

Learn more: https://shieldedstack.com