Mastra AI Framework npm Packages Compromised in Supply Chain Attack
An attacker compromised the Mastra AI Framework npm organization and injected malicious code across 140+ packages by adding a fake dependency that exploited npm's version resolution system. The attack targeted a widely-used framework for building AI agents and retrieval-augmented generation pipelines, affecting downstream developers and systems that installed the poisoned packages.
What happened
An attacker compromised legitimate Mastra credentials and introduced a malicious phantom dependency named 'easy-day-js' across 140+ packages in the Mastra AI framework ecosystem on npm.
The malicious package was a typosquat of the legitimate dayjs date library and contained an obfuscated postinstall dropper that downloaded and executed a second-stage payload from attacker-controlled servers before deleting itself to remove traces.
The attack exploited npm's version resolution mechanism: after injecting a clean, credible bait version, the attacker published a malicious version 1.11.22, which npm automatically pulled on fresh installations due to the dependency being pinned as '^1.11.21'.
Reported impact
Mastra packages are downloaded roughly 1.1 million times per week from npm, and StepSecurity warned that any environment that installed @mastra packages on the day of the attack should be treated as compromised.
The malicious payload was silently delivered to developers and systems installing the compromised packages, allowing attacker-controlled code execution.
Index analysis
The attack targeted a popular open-source AI framework used for building agents and retrieval-augmented generation systems, affecting a wide supply chain of downstream users and applications.
Microsoft's threat intelligence group identified the attack and recommended users downgrade to previous versions, use specific package versions with lockfiles, and review their environments for compromise.
Governance controls
Microsoft's GitHub and npm did not prevent the attack despite the attacker using compromised legitimate credentials, indicating a gap in credential rotation and account security monitoring.
The attack succeeded because npm's dependency resolution mechanism automatically fetched the latest matching version without requiring explicit approval or visibility from package maintainers.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.