Someone Wallpapered the @mastra npm Namespace With Malicious Builds

A single npm account belonging to a Mastra maintainer was used to mass-publish malicious versions of 144 packages under the @mastra/* namespace, in what the attacker themselves labeled easy-day-js.

Mastra, if you haven't run into it yet, is a TypeScript framework for building agentic AI apps. Lots of glue code for LLM calls, tools, memory, evals. Popular enough that hijacking the publishing identity behind it is a high-value move.

The account in question — ehindero — pushed compromised builds across the entire namespace in a short window. Multiple supply-chain security shops, including JFrog, Socket, SafeDep, and StepSecurity, flagged the activity and started pulling versions apart.

This is not a clever new AI-specific attack. It's classic npm account takeover, the same primitive that gave us event-stream, ua-parser-js, and the whole sad genre of "maintainer credential gets phished, ecosystem eats poisoned tarballs." The novelty here is the blast radius: 144 packages in one namespace, all riding the AI-agent hype curve straight into developer machines and CI runners.

The malicious versions carry post-install behavior aimed at credential and environment exfiltration — the usual menu for npm-borne malware. If you've built anything on Mastra and pulled fresh installs during the affected window, treat every secret reachable from that build environment as burned. API keys for model providers. Cloud tokens. Anything mounted into the agent's tool surface.

Mastra-the-project did not write the bad code. A human with publishing rights did, or someone who took over that human's session.

Which brings us to the part the AI angle actually matters for. Agent frameworks sit in a uniquely greedy position in the dev stack. They typically hold OpenAI or Anthropic keys, vector DB credentials, sometimes shell or browser tool access. A poisoned @mastra/core install isn't just stealing your .npmrc; it's potentially scraping the keys that bill against your model account and the tool credentials your agents use to act on the world.

If you're running Mastra in anything that touches production:

• Pin to versions published before the compromise window and audit your lockfiles for any @mastra/* install that lands after it.
• Rotate model-provider keys, cloud credentials, and any secret your agents could read at runtime.

For maintainers watching this from a safe distance: npm's mandatory 2FA for high-impact packages exists for exactly this scenario, and hardware-backed factors remain meaningfully harder to phish than TOTP. The easy-day-js name is on the nose. Publishing access to a hot AI namespace, with no second factor between an attacker and 144 packages, is in fact an easy day.

The AI part is the payload's appetite. The attack is the same one we've been losing to for a decade.