Mastra npm Supply-Chain Attack Backdoored 140+ Packages via easy-day-js Typosquat

Jun 17, 2026 · Original article ↗

Summary

StepSecurity reports that an attacker used compromised Mastra organization credentials to add the easy-day-js typosquat to 140+ packages; its postinstall dropper fetched a second-stage payload. A controlled Harden Runner test blocked the download; credential theft was a

Key points

StepSecurity reports that on June 17, 2026, an attacker used compromised @mastra organization credentials to republish more than 140 packages with easy-day-js added as a production dependency.
The clean [email protected] bait version was followed by malicious [email protected]; the ^1.11.21 dependency range could resolve to the malicious version during installation.
Version 1.11.22 included an obfuscated setup.cjs file and a postinstall hook that ran it automatically.
The dropper disabled TLS certificate verification, wrote installation markers to temporary files, fetched a second-stage payload, launched it as a detached process, and deleted itself.
The article says the second-stage payload was not embedded in the package; environment-variable harvesting and exfiltration were described as likely, not confirmed.
In StepSecurity's controlled GitHub Actions test, Harden Runner blocked the payload download, so the second stage did not run and credential exfiltration was not observed in that test.
StepSecurity says the payload-download IP was added to its Harden Runner Global Block List.

Article Details

Attack Vectors: The attacker used compromised @mastra organization credentials to publish 140+ packages with easy-day-js added as a production dependency.
The [email protected] typosquat used a postinstall hook to run an obfuscated setup.cjs dropper during npm installation.
The dropper attempted to download a stage-two payload from an attacker-controlled URL, then launch it as a detached background process.
The package impersonated dayjs by copying its metadata; the clean [email protected] bait version was dependency-pinned with a range that resolved to the later malicious version.
Defensive Notes: Treat installations of affected @mastra packages published on 2026-06-17 as potentially compromised, according to the article.
The article recommends restricting workflow outbound connections with an allowlist; Harden Runner block mode prevented the observed payload download.
Check easy-day-js package versions and tarballs for the malicious 1.11.22 release, the setup.cjs file, and its postinstall hook.
The article says the dropper sets NODE_TLS_REJECT_UNAUTHORIZED=0, writes markers under the temporary directory, launches a detached process, and deletes setup.cjs; account for these behaviors during investigation.

Indicators of compromise

Type	Indicator	Context
EMAIL	`sergey2016@tutamail[.]com`	Email associated in the article with the attacker account that published the malicious easy-day-js versions.
IPV4	`23[.]254[.]164[.]123`	Stage-two command-and-control address passed to the detached payload; the article says it was not contacted in the controlled test.
IPV4	`23[.]254[.]164[.]92`	Attacker-controlled stage-one server used to serve the stage-two payload on port 8000.
URL	`hxxps[:]//23[.]254[.]164[.]92:8000/update/49890878`	Specific attacker-controlled URL used to download the stage-two payload; the article reports the request was blocked during testing.