malware npm

@mastra/arize

discovered 2026-06-17

First-party @mastra package republished by the compromised ehindero account on 2026-06-17 with library code unchanged and a single injected dependency (easy-day-js ^1.11.21) that drops a cryptocurrency-stealing RAT. Published with dist.attestations=null (no OIDC/SLSA provenance).

more…

Threat types

rat c2_agent crypto_drainer credential_stealer persistence

Malicious versions

1.2.3

Campaigns

@mastra npm Scope Takeoverattributed-to

Read the full analysis →