Someone Wallpapered the @mastra npm Namespace With Malicious Builds

Key points

• A single npm account, ehindero, was used to mass-publish malicious versions across 144 @mastra/* packages.
• JFrog, Socket, SafeDep, and StepSecurity flagged the activity independently.
• The attack was named easy-day-js by whoever ran it.
• Agent frameworks hold model-provider keys and tool credentials, making the payload's appetite unusually large.
• Npm's mandatory 2FA for high-impact packages exists precisely for this scenario.

What happened?

A maintainer account, ehindero, published compromised builds across the entire @mastra/* namespace in a short window. Mastra is a TypeScript framework for building agentic AI apps: glue code for LLM calls, tools, memory, and evaluations. Popular enough that its publishing identity is a high-value target.

This isn't a clever AI-specific attack. It's classic npm account takeover, the same primitive that gave us event-stream and ua-parser-js. The novelty is the blast radius: 144 packages in one namespace, all riding the AI-agent hype curve straight into developer machines and CI runners. We covered the same post-install exfiltration pattern on 1 June 2026 in "Malicious npm Package codexui-android Pulls 29K Weekly Downloads, Targets OpenAI Codex Tokens".

Mastra-the-project did not write the bad code. A human with publishing rights did, or someone who took over that human's session.

Why does the AI-agent angle actually matter here?

Agent frameworks sit in a uniquely greedy position in the dev stack. They typically hold OpenAI or Anthropic keys and vector database credentials. A poisoned @mastra/core install isn't just stealing your .npmrc; it's potentially scraping the keys that bill against your model account and the credentials your agents use to act on the world.

The malicious versions carry post-install behavior aimed at credential and environment exfiltration. If you've built anything on Mastra and pulled fresh installs during the affected window, treat every secret reachable from that build environment as burned.

Should you worry?

If you're running Mastra in anything that touches production, two things matter now. Pin to versions published before the compromise window and audit your lockfiles for any @mastra/* install that lands after it. Rotate model-provider keys, cloud credentials, and any secret your agents could read at runtime.

For maintainers watching from a safe distance: npm's mandatory 2FA for high-impact packages exists for exactly this scenario. Hardware-backed factors remain meaningfully harder to phish than time-based one-time passwords. The easy-day-js label is on the nose. Publishing access to a hot AI namespace, with no second factor standing between an attacker and 144 packages, genuinely is an easy day.

The payload's appetite is new. The attack itself is the one we've been losing to for a decade.