SlowMist: Over 140 Mastra npm packages suffer from supply chain attacks, posing security risks

Foresight News reports, according to SlowMist monitoring, a coordinated supply chain attack targeting more than 140 npm packages is underway. The affected packages automatically add a dependency on easy-day-js@^1.11.21 during installation, which resolves to the malicious version easy-day-js@1.11.22. This triggers attacker-controlled code via installation hooks.

Potential attacker behaviors include: executing code upon installation, maintaining persistence on Windows/macOS/Linux, collecting browser history, inventorying cryptocurrency wallet extensions, exposing credentials or CI keys through subsequent operations, and leaking data.

For any systems that have installed affected versions, consider them as potentially compromised: remove the malicious version and easy-day-js, delete node_modules and package caches, reinstall known clean versions (using verified lock files), isolate affected hosts, preserve logs, remove persistence traces, and rotate npm, GitHub, cloud service, SSH/Git, CI/CD, and wallet-related credentials if exposure is possible.