17 June 2026 - 18:04
Category: Trust Issues
Oh look, another flawless npm dependency
An attacker used stale credentials to hijack Mastra npm and push a sneaky remote access trojan via a typosquatted package. Because cleanup is just too much to ask.
Source: Phoenix Security
The Full Story
Some brilliant attacker hijacked the @mastra npm organization using dusty, forgotten contributor credentials to spread 144 malicious packages to unsuspecting developers. This little supply chain surprise affected anyone using the framework by injecting a nasty remote access trojan via a typosquatted date library. Apparently, keeping your browser history and crypto wallets private is now a luxury. We might protect our environments if we finally purge stale credentials, but that involves actually managing our access.