# mastra-npm-packages-trojanized-via-maintainer-account-compromise: Mastra npm Packages Trojanized via Maintainer Account Compromise

> Mastra npm Packages Trojanized via Maintainer Account Compromise is a high-severity supply chain compromise issue in easy-day-js, a package. Affected: ~144 trojanized Mastra npm package versions (June 17 2026). It has been exploited in the wild.

- **Canonical URL:** https://catalog.anomity.ai/vuln/mastra-npm-packages-trojanized-via-maintainer-account-compromise
- **Aliases:** ti-038
- **Severity:** high
- **Attack type:** Supply chain compromise, Malware
- **Component:** easy-day-js (package)
- **Package:** easy-day-js (npm)
- **Exploited in the wild:** yes
- **Published:** 2026-06-17
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/mastra-npm-packages-trojanized-via-maintainer-account-compromise

## Summary

Wiz is tracking the trojanization of dozens of npm packages published by the Mastra (AI agent framework) organization after a maintainer account compromise. Attackers added a malicious dependency, easy-day-js, to affected packages, causing a second-stage payload to download and execute during install. Linked to UNC1069.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| ~144 trojanized Mastra npm package versions (June 17 2026) | no fixed version listed |

## Am I affected by this vulnerability?

You are affected if you run ~144 trojanized Mastra npm package versions (June 17 2026).

## How do I fix it?

Audit lockfiles and node_modules for the easy-day-js dependency and any compromised Mastra package versions; pin to known-good releases. Treat any workstation or CI host that installed the affected versions as compromised and rotate exposed secrets.

## References

- article: https://thehackernews.com/2026/06/144-mastra-npm-packages-compromised-via.html

## Related vulnerabilities

- [litellm-1-107-0-compromised-on-pypi-and-docker-a-cook-pth-startup-hook](https://catalog.anomity.ai/vuln/litellm-1-107-0-compromised-on-pypi-and-docker-a-cook-pth-startup-hook) — critical
- [miasma-npm-worm-compromises-31-red-hat-cloud-services-packages-via-ci](https://catalog.anomity.ai/vuln/miasma-npm-worm-compromises-31-red-hat-cloud-services-packages-via-ci) — critical
- [apex-accelerator-ref8801-a-fake-web3-accelerator-s-npm-coding-agent](https://catalog.anomity.ai/vuln/apex-accelerator-ref8801-a-fake-web3-accelerator-s-npm-coding-agent) — high
- [tensorlake-npm-sdk-0-5-144-compromised-by-a-shai-hulud-chaindrop-worm](https://catalog.anomity.ai/vuln/tensorlake-npm-sdk-0-5-144-compromised-by-a-shai-hulud-chaindrop-worm) — critical
- [memtensor-compromise-poisoned-openclaw-memory-plugin-and-memoryos](https://catalog.anomity.ai/vuln/memtensor-compromise-poisoned-openclaw-memory-plugin-and-memoryos) — critical
- [mandiant-hijacked-ai-coding-assistant-session-deploys-shai-hulud-across](https://catalog.anomity.ai/vuln/mandiant-hijacked-ai-coding-assistant-session-deploys-shai-hulud-across) — critical

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=mastra-npm-packages-trojanized-via-maintainer-account-compromise