One dormant npm account just backdoored 143 packages in the Mastra AI framework

On June 17, 2026, someone took over a single dormant npm maintainer account and used it to poison 143 packages across the entire @mastra scope in 27 minutes. The packages had a combined weekly download count of over 1.1 million. @mastra/core alone pulls roughly 4 million downloads a month. If you installed or updated any @mastra package on or after June 17, your environment should be considered compromised.

The compromised account belonged to ehindero, a real former Mastra contributor who published legitimate alpha releases in late 2024 and early 2025 before going dormant. npm does not expire scope publish permissions on inactivity. Nobody revoked the access. The account’s email was changed to a tutamail.com address, which strongly suggests takeover rather than insider action.

How the attack worked

The attacker was patient. On June 16, they published [email protected], a byte-for-byte copy of dayjs, one of the most popular date libraries in the JavaScript ecosystem. It was clean. It did nothing wrong. It was bait.

The next day at 01:01 UTC, they published [email protected]. This version contained an obfuscated postinstall script that disabled TLS verification, fetched a second-stage payload from a raw IP address, executed it, then deleted itself.

Then, between 01:12 and 02:39 UTC, the attacker republished the entire @mastra scope. Every single package got one new line in its package.json: "easy-day-js": "^1.11.21". The caret range meant npm would resolve to the latest patch version, which was now the malicious 1.11.22. The dependency was never imported anywhere in Mastra’s actual source code. It existed purely to trigger the install hook.

Mastra’s own repository was clean. The attacker injected the dependency into the published tarballs at publish time, not into the git repo. Mastra confirmed this in PR #18056.

What the payload does

The second-stage payload is a cross-platform cryptocurrency stealer and remote access trojan. According to analysis from Snyk, StepSecurity, and Phoenix Security, it targets:

LLM API keys (OpenAI, Anthropic, and others stored in environment variables and config files)
Cryptocurrency wallet data
CI/CD credentials and secrets
SSH keys

The payload runs in the background after npm install completes. The user never sees a prompt, an error, or any visible sign that something went wrong.

Why this matters

This is not a zero-day. This is not a sophisticated exploit. A contributor left a project, their npm credentials were never revoked, and someone took over the account. That is the entire attack vector. Project hygiene is the root cause.

npm’s permission model treats scope publish access as permanent until manually revoked. There is no expiration, no inactivity timeout, no periodic re-authentication. When a contributor leaves a project, their access lives on indefinitely unless someone explicitly removes it. Most projects do not have a checklist for this.

The scale amplifies the problem. @mastra is not a niche package. It is a widely used framework for building AI agents, RAG pipelines, and AI workflows. Hundreds of projects depend on it transitively. A single compromise in a popular scope cascades through the entire dependency tree.

The broader pattern

This is the second major AI-related npm supply chain attack in June 2026. Earlier in the month, Microsoft Threat Intelligence documented the Red Hat npm Miasma campaign, a credential-stealing worm that spread through npm dependencies. The JetBrains Marketplace also disclosed 15 malicious AI coding plugins on the same day, stealing OpenAI and DeepSeek API keys from developers.

The AI ecosystem is becoming a priority target. AI projects handle API keys worth real money, CI/CD tokens with cloud access, and training data that took months to produce. Attackers know this. The combination of high-value credentials and often-lax access controls in open-source projects makes AI frameworks particularly attractive.

What to do

If you installed or updated any @mastra package on or after June 17, 2026:

Treat your environment as compromised. Rotate any API keys, tokens, or credentials that were present in the environment.
Check your node_modules for easy-day-js. If it is there, you were exposed.
Audit your environment for signs of the second-stage payload. Look for unexpected network connections to raw IP addresses.
Downgrade to the last known-good version of any @mastra package you depend on.