# Mastra NPM Packages Trojanized with Malicious Dependency Injection - 116 Packages Compromised

> On June 17, 2026, attackers compromised a maintainer account for the Mastra npm organization and republished 116 packages including the critical @mastra/core package (28M monthly downloads) by injecting a malicious dependency named easy-day-js. The attack targeted the widely-adopted open-source AI framework, affecting developer workstations, CI/CD pipelines, and build environments across the global developer community.

- **Published:** 2026-06-17T00:00:00Z
- **Last reviewed:** 2026-06-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0977
- **ID:** TL-2026-0977
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** Lazarus Group (North Korea)
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

A significant supply chain attack against the Mastra AI framework ecosystem occurred on June 17, 2026, when threat actors gained control of a maintainer account within the Mastra npm organization. Rather than directly modifying source code, the attackers employed a sophisticated dependency injection technique, introducing a malicious package named easy-day-js into 116 packages over a 27-minute window. The primary target was @mastra/core, a foundational component of the Mastra framework that receives hundreds of thousands of weekly downloads. With Mastra commanding 28 million monthly downloads across its ecosystem, this compromise potentially exposed the supply chain to thousands of organizations building AI applications. The malicious dependency was designed to execute during package installation and build processes, with potential impact spanning developer workstations, continuous integration and continuous deployment (CI/CD) pipelines, and production build environments. The compromise was facilitated through account takeover, likely via credential compromise, multi-factor authentication bypass, or social engineering. This incident demonstrates the critical vulnerability of open-source package managers to supply chain attacks and the need for enhanced dependency verification, package signing, and build environment isolation. The scale and sophistication of this attack—targeting the foundation of an AI development platform during a period of rapid AI adoption—suggests possible state-sponsored or organized cybercriminal involvement seeking to establish persistent access to downstream developers and their applications.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1525 Implant Internal Image
- T1556 Modify Authentication Process
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1528 Steal Application Access Token
- T1566 Phishing
- T1518 Software Discovery
- T1005 Data from Local System
- T1555 Credentials from Password Stores
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1485 Data Destruction
- T1496 Resource Hijacking
- T1587 Develop Capabilities
- T1583 Acquire Infrastructure
- T1199 Trusted Relationship
- T1136 Create Account
- T1550 Use Alternate Authentication Material
- T1578 Modify Cloud Compute Infrastructure
- T1569 System Services
- T1115 Clipboard Data
- T1090 Proxy
- T1499 Endpoint Denial of Service
- T1053 Scheduled Task/Job
- T1098 Account Manipulation
- T1566 Phishing
- T1030 Data Transfer Size Limits

## Sources

- [Wiz Threat Report: Mastra Packages Trojanized with Malicious Dependency](https://threats.wiz.io/all-incidents/mastra-packages-trojanized-with-malicious-dependency)
- [Mastra Framework Official Repository](https://github.com/mastra-ai/mastra)
- [NPM Security Advisory Database](https://www.npmjs.com/advisories)
- [OWASP: Supply Chain Security](https://owasp.org/www-community/attacks/Supply_chain_attack)
- [CWE-494: Download of Code Without Integrity Check](https://cwe.mitre.org/data/definitions/494.html)
- [NPM Package Manager Security Best Practices](https://docs.npmjs.com/cli/v8/configuring-npm/package-lock.json)
- [NIST Software Supply Chain Security Guidance](https://csrc.nist.gov/publications/detail/sp/800-161/final)
- [Mastra AI Framework Official Website](https://mastra.ai/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0977