Friday 26 June 2026 06:40:04 GMT+02:00
Netcrook
#Mastra packages
One Hijacked npm Identity Can Poison an Entire Dependency Chain
A maintainer-account takeover tied to poisoned Mastra packages shows how package registries can become malware delivery systems when publisher trust is broken.
When a Trusted Package Turns Toxic: The Mastra npm Intrusion
A hijacked maintainer path, a typosquat package, and two very different payloads show how supply-chain abuse can reach far beyond one namespace.