Mastra npm org hijacked: 116 packages drop a remote payload via typosquatted easy-day-js
An attacker stole a Mastra maintainer account and republished 116 packages within 27 minutes, inserting a hidden dependency on easy-day-js. The typosquatted module runs a post‑install dropper that disables TLS validation and fetches a second‑stage payload, affecting roughly 28 million monthly downloads.