Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-06-18 · source-backed
On June 17 an attacker hijacked a stale contributor account and republished 142 packages under the @mastra scope, injecting a typosquatted easy-day-js dependency. The postinstall payload disabled TLS verification, pulled a second-stage C2 binary, and harvested browser data plus credentials from 166 crypto-wallet extensions. @mastra/core alone sees about 918K weekly downloads, so the blast radius is large. If you build on Mastra, roll back to pre-incident versions and rotate npm, GitHub, cloud, and LLM API tokens now. (The Hacker News)
Each link below shares sources, entities, or timing with this story.
Mastra uses MySQL / Shared entities / Earlier coverage
Linked by a graph relationship (Mastra uses MySQL); both cover GitHub, Mastra; earlier GitHub coverage from 2026-06-15.
Mastra released Mastra Factory / Shared entities / What happened next / Tension
Linked by a graph relationship (Mastra released Mastra Factory); both cover GitHub, Mastra; picks up the GitHub thread on 2026-07-28.
Shared entities / Same source domain / Shared topic / Earlier coverage
Both cover GitHub, The Hacker News; reported by the same outlet (thehackernews.com); overlapping topics (browser, contributor, credential).
Mastra benchmarked against LongMemEval / Shared entities / What happened next / Tension
Linked by a graph relationship (Mastra benchmarked against LongMemEval); both cover GitHub, Mastra; picks up the GitHub thread on 2026-07-28.
Shared entities / Shared topic / What happened next
Both cover GitHub, Mastra; overlapping topics (back, core, mastra); picks up the GitHub thread on 2026-08-17.
Both cover GitHub, LLM API; overlapping topics (account, attacker, credential); picks up the GitHub thread on 2026-08-13.
Shared entities / Same source domain / What happened next
Both cover GitHub, The Hacker News; reported by the same outlet (thehackernews.com); picks up the GitHub thread on 2026-07-28.
Shared entity: GitHub / Same source domain / Shared topic / Earlier coverage
Both cover GitHub; reported by the same outlet (thehackernews.com); overlapping topics (account, attacker, cloud).