Mastra AI Framework Poisoned in npm Supply-Chain Attack

Hackers poisoned software packages in the popular Mastra artificial intelligence framework, used to build AI agents, workflows and retrieval-augmented generation pipelines.

See Also: AI Impersonation Is the New Arms Race-Is Your Workforce Ready?

Microsoft’s threat intelligence group said that the supply-chain attack compromised numerous packages in the Mastra-AI npm ecosystem and appeared to begin after an attacker compromised legitimate Mastra credentials.

“The attacker introduced a phantom dependency into the compromised packages. The malicious dependency was published by a single anonymous maintainer 24 hours ago,” Microsoft said late Tuesday.

“Users are advised to downgrade to previous versions immediately, use mastra@1.13.0 explicitly and use lockfiles,” it said.

Mastra packages are downloaded roughly 1.1 million times per week from npm, the package manager for the JavaScript programming language. It’s owned by Microsoft’s GitHub cloud-based code development platform.

“If you installed any @mastra package today, treat your environment as compromised,” warned software supply-chain security platform StepSecurity in a Wednesday alert.

StepSecurity said the attacker “compromised the @mastra npm organization and quietly added easy-day-js as a dependency across 140+ packages in the Mastra AI framework ecosystem.” The package name “is a typosquat of the popular dayjs date library, and its latest version contained an obfuscated postinstall dropper that downloaded and ran a second-stage payload from attacker-controlled servers, then deleted itself to remove any trace.”

The attack began Tuesday, when the attacker injected “a clean, fully functional copy of the legitimate dayjs date library with no malicious code at all,” with this “bait” version designed to look “credible,” it said.

“The trick is in how npm resolves versions: the dependency was pinned as 'easy-day-js':' ^1.11.21', which means npm always resolves to the latest matching version at install time. So once the attacker published the malicious 1.11.22, every fresh npm install would automatically pull the payload without needing any further changes to the @mastra packages themselves,” StepSecurity said.

Many continuous integration environments are set to automatically run commands such as npm install whenever a new version gets built. This automatically pulls in the latest version of the software, including any poisoned software, which can persist for hours or days before being detected and removed. As a result, some cybersecurity experts recommend organizations introduce cooldown periods before they pull the latest package versions – advice that can be hard to follow if maintainers don’t segregate functional from security updates (see: Flurry of Supply-Chain Software Library Attacks).

The fallout from the attack remains unclear, and may take weeks or months to come to light.

Poisoning npm Packages

The attack against the Mastra AI framework is the latest to involve the poisoning of npm packages. Many of these attacks trace to the cybercrime group TeamPCP, also tracked by cybersecurity researchers as UNC6780. The group specializes in poisoning widely used open-source software, including LiteLLM, TanStack and Trivy, oftentimes by injecting malicious workflows into GitHub Actions.

The group often uses a purpose-built, self-replicating npm worm it developed called Shai-Hulud to infect GitHub projects.

Victims of TeamPCP’s attacks have included the European Commission and GitHub, as well as recruiting firm Mercor, application security testing platform Checkmarx and Linux distribution maker Red Hat.

Threat intelligence firm Flare said it’s likely that TeamPCP functions as an initial-access supplier to multiple monetization partners including the Vect ransomware group Lapsus$. Deep Specter Research on Wednesday reported the campaign that penetrated Red Hat as well as Microsoft GitHub repositories earlier this month involved a more aggressive version of the credential-stealing worm Shai-Hulud, called Miasma. While TeamPCP originally developed the worm, it released the source code publicly, leading to copycat attacks and complicating attribution.

Either version of the worm “executes on a developer machine, harvests every credential it can reach and reuses those credentials to (1) publish poisoned package versions, (2) inject an obfuscated dropper into source repositories and (3) stage stolen secrets in throwaway ‘dead-drop’ repos,” Deep Specter Research said.

The campaign earlier this month compromised at least 151 repositories, affecting 26 organizations and quickly generated 516 malicious packages, later rising to over 1,200, it said. Identifying poisoned packages is challenging, because the worm can back-date changes to years in the past, which makes them look legitimate, as well as list changes as having been committed by legitimate authors, including their name, username and photo.

Deep Specter Research said it submitted two security reports to GitHub, detailing how those design problems are being abused. The firm said GitHub responded by saying, in effect, “that back-dated (retroactive) commits are a legitimate use case for developers working offline,” and that users can choose to enforce the requirement for “cryptographic signing” of identities, but that it is “not a platform default.”

npm Preps Security Overhaul

Microsoft’s GitHub has pledged security changes. On June 9, it announced that the forthcoming version 12 release of npm will include major new supply-chain security functionality.

By default, npm install v12 will no longer allow scripts from dependencies to be run, or resolve Git dependencies, including from remote URLs. This functionality can be overridden on a script-by-script basis, by them to an allow list.

GitHub expects to release v12 next month and said users can prepare by upgrading now to npm 11.16.0 or later, which includes new functionality that allows them to review “which packages have scripts, approve the ones you trust and commit the updated package.json. After that, only the scripts you approved keep running once you upgrade. Anything you leave unapproved will stop.”

Such changes are overdue, said Katie Paxton-Fear, staff security advocate at static code analysis toolmaker Semgrep.

“If you asked a security engineer to design a package manager from scratch with supply-chain attacks in mind, they probably wouldn’t include a mechanism that executes arbitrary shell scripts from third-party code automatically without prompting at install time. And yet, that’s exactly what npm used to do,” she said.

“Every time you ran npm install, npm handed control of your machine to every package in your dependency tree, including packages three or four levels deep that you’ve never heard of, written by maintainers you’ve never audited.”

Users have been demanding this change, on security grounds, for some time. “There is no justifiable reason for running arbitrary shell scripts by default,” read one such request, posted to the npm forum on GitHub, last November.

While the feature has legitimate use cases, Paxton-Fear said it’s also been abused in the s1ngularity campaign last August that used GitHub Actions to target the Nx build system through various npm packages, plus a spate of Shai-Hulud worm and recent copycat attacks since October 2025, and the March compromise of the Axios JavaScript library for making HTTP requests (see: Backdooring of JavaScript Library Axios Tied to North Korea).

Other package managers long ago blocked scripts in dependencies by default unless explicitly allowed, including npm in January 2025 with version 10, as well as Bun and Yarn v2+ in Plug’n’Play mode, she said.

“The encouraging part is that the response is moving toward structural guardrails instead of asking every developer to catch every bad package in time,” said Semgrep CEO Isaac Evans (see: How AI Supply-Chain Monitor Spotted Unfolding Axios Attack).