Mastra AI Hit By npm Compromise

Microsoft security researchers have uncovered a significant supply chain attack targeting the Mastra-AI npm ecosystem, resulting in the compromise of over 80 packages via account takeover. The incident used a "phantom dependency" injection technique designed to evade detection while establishing persistent C2 communication.

The unknown threat actor gained unauthorized access to legitimate npm accounts, allowing them to inject malicious dependencies into widely used packages, most notably mastra@1.13.1. The attack leverages a typosquatting strategy; the injected dependency, easy-day-js@1.11.22, masquerades as the legitimate dayjs library. Mastra has an open-source platform for building AI agents, as well as some add-on capabilities for observability and other functions.

Mastra co-founder Sam Bhagwat said that the company has confirmed the compromise and said the incident was the result of one of the product’s maintainers being compromised. 

“Reports are accurate. We have been hit by a supply chain attack. A malicious postinstall script that exfiltrated credentials and then self-deleted was added to specific versions of our packages. The incident is over -- we have unpublished or deprecated the relevant package versions,” Bhagwat said. 

“The root cause is that one of our maintainers was compromised. Between 6:12 PM and 6:37PM PT yesterday, a token associated with their account published 116 malicious packages, almost all in the @mastra/ namespace.”

Upon installation, the malicious dependency executes a post-install script (setup.cjs), which functions as a loader for the secondary payload.

Technical Analysis of the Payload

The setup.cjs script has a number of capabilities:

• TLS Evasion: The script disables SSL verification by setting NODE_TLS_REJECT_UNAUTHORIZED=0. This allows the payload to bypass standard certificate validation, ensuring unrestricted communication with the attacker’s C2 infrastructure.
• Persistence and Anti-Reinfection:The malware creates two local markers—~/.pkg_history (path tracking) and ~/.pkg_logs (XOR-encoded indicator)—to identify already-infected hosts and prevent redundant infections.
• Secondary Stage Retrieval: The script fetches a secondary JavaScript payload from 23[.]254[.]164[.]92:8000/update/49890878.
• Invisible Execution: The downloaded payload is executed as a detached, invisible process (windowsHide=true) with the C2 endpoint 23[.]254[.]164[.]123:443passed as an argument.
• Evidence Removal: Post-execution, the setup.cjs script deletes itself from the filesystem to minimize the forensic footprint.

Affected Packages

The breach is extensive, affecting more than 100  packages within the Mastra-AI ecosystem. Key identified packages include:

• mastra@1.13.1
• mastra/pg
• mastra/mcp
• mastra/schema-compat
• mastra/ai-sdk
• mastra/rag

Remediation Recommendations

Given the nature of the post-install exploitation, security teams should prioritize the following actions:

1. Dependency Audit: Immediately review package.json and package-lock.json files for the presence of easy-day-js or other unauthorized dependencies.
2. Traffic Analysis: Investigate network logs for outbound connections to 23.254.164.92 (port 8000) and 23.254.164.123 (port 443).
3. Host-Level Scanning: Check for the presence of the identified marker files: ~/.pkg_history and ~/.pkg_logs.
4. Version Pinning/Cleanup: Update affected mastra packages to versions explicitly confirmed as clean by the maintainers and rotate credentials for any systems where these dependencies were executed.

Mastra’s Bhagwat said the company has disabled token-based publishing capabilities for npm and is now requiring MFA for all publishes.