Mastra npm Packages Trojanized via Maintainer Account Compromise
Mastra npm Packages Trojanized via Maintainer Account Compromise is a high-severity supply chain compromise issue in easy-day-js, a package. Affected: ~144 trojanized Mastra npm package versions (June 17 2026). It has been exploited in the wild.
Is easy-day-js running on your developers' machines? Anomity inventories the AI agents, MCP servers, extensions and skills on every developer device, so you can see what this advisory touches. Detect this across your developers' devices with Anomity →
Key facts
- ID
mastra-npm-packages-trojanized-via-maintainer-account-compromise- Severity
- high
- Attack type
- Supply chain compromise, Malware
- Component
- easy-day-js · package
- Package
easy-day-jsnpm- Known exploited
- Yes
- Published
- Last verified
What is this vulnerability?
Wiz is tracking the trojanization of dozens of npm packages published by the Mastra (AI agent framework) organization after a maintainer account compromise. Attackers added a malicious dependency, easy-day-js, to affected packages, causing a second-stage payload to download and execute during install. Linked to UNC1069.
Affected versions
| Affected | Fixed in |
|---|---|
~144 trojanized Mastra npm package versions (June 17 2026) | No fixed version listed |
Am I affected by this vulnerability?
You are affected if you run ~144 trojanized Mastra npm package versions (June 17 2026).
How do I fix it?
Audit lockfiles and node_modules for the easy-day-js dependency and any compromised Mastra package versions; pin to known-good releases. Treat any workstation or CI host that installed the affected versions as compromised and rotate exposed secrets.