Mastra npm Supply-Chain Attack — "easy-day-js"

On 2026-06-17, an attacker hijacked the npm account of a legitimate former Mastra contributor (ehindero) whose @mastra scope publishing rights were never revoked. In an 88-minute automated campaign (01:12–02:39 UTC), the attacker republished 142 packages under the @mastra scope (144 total compromised artifacts including the bait/dropper packages), each with a single injected dependency: easy-day-js — a typosquat of the legitimate dayjs date library. Mastra is a popular open-source JS/TS framework for building AI applications; the affected packages exceed 1.1M combined weekly downloads (@mastra/core alone ~918K/week).

easy-day-js is a clone of dayjs that ships an obfuscated postinstall hook (node setup.cjs --no-warnings). On install, setup.cjs: (1) sets NODE_TLS_REJECT_UNAUTHORIZED=0 to disable TLS verification, (2) writes beacon-marker files (.pkg_history, .pkg_logs) to the user home/temp directory, (3) fetches a second-stage payload from attacker C2 over unvalidated TLS, (4) writes it as a random 24-hex-char .js file, (5) spawns it as a DETACHED, hidden background process (detached:true, stdio:'ignore', windowsHide:true, then .unref()) that outlives the install, and (6) self-deletes (fs.rmSync(__filename)) to destroy the primary forensic artifact. The second stage is a remote-access trojan oriented toward cryptocurrency theft and credential/API-key harvesting (LLM and cloud keys).

This is distinct from prior Shai-Hulud, PyPI, and AwesomeMotive supply-chain incidents: it is an npm-scope-wide hijack of a single AI framework org, anchored on a dayjs typosquat as the payload carrier.

Defender priority: The highest-fidelity catch is a node process spawning a detached child node process within seconds of npm install, combined with the env var NODE_TLS_REJECT_UNAUTHORIZED=0 and outbound to 23.254.164.92:8000 / 23.254.164.123:443. Block both C2 IPs at the perimeter now and sweep package-lock.json / node_modules for easy-day-js across all build agents and developer endpoints.

Hunter note: Reporting differs on exact package count (116 / 140 / 142 / 144) and on whether markers land in temp vs. home dir — both paths are hunted. Account attribution differs between ehindero (publisher) and sergey2016 (bait-package publisher); both are former/related contributor identities. Atomic file hashes for setup.cjs and stage-2 are not yet broadly published — behavioral detection is primary; CSV uses placeholders for hashes.

Hunt Hypotheses (fidelity-ordered)

1. H1 (high): A node process spawns setup.cjs as a child of an npm/npx/CI install — postinstall execution. low FP
2. H2 (high): A node process spawns a second detached node child running a random-hex-named .js from the home/temp dir shortly after install. low FP
3. H3 (high): Any process sets NODE_TLS_REJECT_UNAUTHORIZED=0 in its environment/command line. med FP
4. H4 (high): Outbound connection to C2 23.254.164.92 (:8000) or 23.254.164.123 (:443) from a node process. low FP
5. H5 (medium): Beacon-marker files .pkg_history / .pkg_logs written to a home/temp directory. med FP
6. H6 (medium): A .js / .cjs dropper self-deletes (FileDeleteInfo) the same file it was just running from, shortly after a network fetch. med FP
7. H7 (high): Presence of easy-day-js in node_modules or package-lock.json on any endpoint/build agent. low FP

Attack Chain

Lockfile / dependency tree (run on every endpoint & build agent)

// Find easy-day-js anywhere in the tree
grep -rln "easy-day-js" --include=package-lock.json --include=package.json /
npm ls easy-day-js                 // per-project
// Pinpoint vulnerable @mastra versions
npm ls @mastra/core | grep -E "1\.42\.1"

Home / temp directory marker sweep

// macOS / Linux
ls -la ~/.pkg_history ~/.pkg_logs 2>/dev/null
find /tmp "$HOME" -maxdepth 1 -name ".pkg_*" -o -regextype posix-extended -regex '.*/[0-9a-f]{24}\.js'
// Windows (PowerShell)
Get-ChildItem -Path $env:USERPROFILE,$env:TEMP -Filter ".pkg_*" -Force -EA SilentlyContinue

npm audit / SCA

npm audit --json | grep -i easy-day-js
// SBOM: assert no resolved url points to easy-day-js or @mastra rev'd after 2026-06-17 01:00 UTC

Note: Because setup.cjs self-deletes, absence of the file does not clear a host — pivot on process/network telemetry (Q1–Q6) and the persistent stage-2 process / markers.

Promotion path: Q1, Q2, Q4 are strong IOA/Prevent candidates (low FP, attacker-specific). Q3, Q5, Q6, Q7 stay Investigate-only until baselined per environment.

1 · Disable npm install scripts fleet-wide (CI + dev)

# Per-runner / per-developer
npm config set ignore-scripts true
# Or enforce per-invocation in pipeline YAML
npm ci --ignore-scripts
# pnpm / yarn equivalents
pnpm config set enable-pre-post-scripts false
yarn config set enableScripts false

2 · Detect & purge easy-day-js across all repos (bash)

#!/usr/bin/env bash
set -euo pipefail
HITS=$(grep -rln "easy-day-js" --include=package-lock.json --include=package.json . || true)
if [ -n "$HITS" ]; then
  echo "[!] easy-day-js referenced in:"; echo "$HITS"
  echo "[*] Remove the dep, rollback @mastra to pre-2026-06-17, then:"
  echo "    rm -rf node_modules package-lock.json && npm ci --ignore-scripts"
fi
# Marker sweep (compromise evidence)
find "$HOME" /tmp -maxdepth 1 \( -name ".pkg_history" -o -name ".pkg_logs" \) 2>/dev/null

3 · Egress block (iptables example)

iptables -A OUTPUT -d 23.254.164.92  -j DROP
iptables -A OUTPUT -d 23.254.164.123 -j DROP
# Windows firewall
New-NetFirewallRule -DisplayName "Block easy-day-js C2" -Direction Outbound \
  -RemoteAddress 23.254.164.92,23.254.164.123 -Action Block

4 · Falcon RTR triage one-liner (Windows)

Get-ChildItem $env:USERPROFILE,$env:TEMP -Force -EA SilentlyContinue |
  Where-Object { $_.Name -match '^\.pkg_(history|logs)$' -or $_.Name -match '^[0-9a-f]{24}\.js$' } |
  Select-Object FullName,LastWriteTime

Behavioral coverage of the install→spawn→C2 chain is strong (Q1/Q2/Q4). Gaps are registry-side publish abuse (needs SCA/SBOM out-of-band) and stage-2 RAT atomic indicators (await vendor hashes — see CSV placeholders). Validate gates in §11 before promoting Q1/Q2/Q4 to Prevent.