Mastra npm Org Compromised: Multiple Packages Trojanized to Drop a Remote Payload via easy-day-js | Blog | Endor Labs

A single hijacked maintainer account pushed multiple trojanized packages across the entire @mastra scope in 27 minutes, each carrying a typosquat dependency that runs a remote payload on install. Combined reach is over 28 million downloads a month.