discovered
First-party @mastra package republished by the compromised ehindero account on 2026-06-17 with library code unchanged and a single injected dependency (easy-day-js ^1.11.21) that drops a cryptocurrency-stealing RAT. Published with dist.attestations=null (no OIDC/SLSA provenance).