Netcrook
#Mastra
Mastra’s npm Trail Turns a Package Update Into a Crypto-Extension Risk
A malicious dependency found in more than 140 Mastra packages shows how a software supply-chain incident can move from build tools to browser-facing cryptocurrency surfaces.
One Hijacked npm Identity Can Poison an Entire Dependency Chain
A maintainer-account takeover tied to poisoned Mastra packages shows how package registries can become malware delivery systems when publisher trust is broken.
When a Trusted Package Turns Toxic: The Mastra npm Intrusion
A hijacked maintainer path, a typosquat package, and two very different payloads show how supply-chain abuse can reach far beyond one namespace.
When a Package Registry Turns into a Blind Spot for AI Builders
Microsoft’s attribution of a Mastra AI-related npm compromise to Sapphire Sleet shows how a software supply chain incident can ripple through developer tooling long before anyone notices a malicious build.
When Trusted Packages Turn Toxic: The Mastra npm Incident and the New Face of Credential Theft
More than 140 npm packages tied to the Mastra AI ecosystem were reported compromised, underscoring how a single poisoned dependency can become a delivery path for infostealers.
Namespace Trust Broke First: The npm Supply Chain Story Hidden Inside Mastra
More than 140 packages in the Mastra namespace were reported as part of a supply-chain compromise, with a typosquatting dependency, easy-day-js, used in a way that could fit install-time malware delivery.
A Trusted npm Namespace Became the Weak Link in an AI Build Chain
A hijacked contributor identity and a burst of package publishing turned the @mastra/* ecosystem into a supply-chain warning for anyone shipping JavaScript or TypeScript at scale.