144 Mastra npm Packages Compromised via Hijacked Contributor Account

A single npm account (ehindero) published 140+ malicious packages across the Mastra scope on June 17, 2026. The packages add a dependency called easy-day-js, a cloned dayjs library that downloads a cross-platform information stealer targeting browser history and 160+ cryptocurrency wallet extensions.