Mastra npm attack: 141 packages backdoored via easy-day-js RAT. Fri Jun 19 Searching for Mastra npm hack, easy-day-js malware, or @mastra supply chain attack June 2026? On June 17, 2026, attackers republished 141 packages in the npm @mastra scope overnight - without touching Mastra's GitHub source. The payload rode in on a single swapped dependency: typosquatted easy-day-js instead of legitimate dayjs. Breaking - June 17, 2026: Security vendors including Socket, StepSecurity, and OX Security disclosed a coordinated npm supply-chain attack against Mastra - an open-source AI agent framework with millions of monthly downloads. BreachHistory indexes every compromised package version at pkg-npm-mastra-easy-day-js-202606. What happened. The attacker did not modify Mastra application source in Git. Instead they: * Published typosquatted easy-day-js - mirroring dayjs metadata (author, homepage, repo URL, version numbering) to pass casual review. * Shipped a clean bait version [email protected] on June 16, then weaponized 1.11.22 with a malicious postinstall hook (node setup.cjs). * Compromised dormant former contributor account ehindero and mass-republished 141 @mastra packages between roughly 01:12-02:39 UTC on June 17, each declaring "easy-day-js": "^1.11.21" so npm resolved the caret range to the malicious dropper. Account sergey2016 uploaded the malicious npm package; reporting ties both accounts to tutamail.com email substitution consistent with takeover. Legitimate prior @mastra releases carried GitHub OIDC provenance; compromised versions published from ehindero lacked SLSA attestations - a red flag teams can enforce in policy. Payload: two-stage RAT, not a simple stealer. Stage 1 is setup.cjs - roughly 4.5 KB of heavily obfuscated JavaScript run at install time. It disables TLS verification, beacons install paths, fetches stage 2 from 23.254.164.92:8000, spawns a detached background process pointed at C2 23.254.164.123:443, then deletes itself from disk. Stage 2 is a cross-platform Node.js remote access trojan (~41 KB) that: * Installs OS-level persistence (Windows Run key, macOS LaunchAgent, Linux systemd user unit) - surviving npm uninstall * Inventories 166 cryptocurrency wallet browser extensions and harvests browser history from Chrome, Brave, and Edge * Exfiltrates host, process, and environment reconnaissance - including high-value LLM API keys and cloud/CI credentials common in AI dev stacks * Polls for operator commands to download and execute arbitrary follow-on modules Socket flagged easy-day-js within six minutes of publication; StepSecurity demonstrated blocking the outbound C2 prevented stage-2 download entirely. There is no CVE - CVE scanners had no detection surface during active exploitation. Scale and who is at risk. OX Security cited ~8 million combined weekly downloads and ~29 million monthly across affected packages; @mastra/core alone exceeds 900,000 weekly installs. Anyone who ran npm install on a @mastra package during the June 17 exposure window - developer laptops, CI runners, cloud build agents - is in scope. Mastra targets AI agent workflows, so compromised hosts often hold OpenAI, Anthropic, and Google API keys alongside npm and GitHub tokens. Representative compromised versions. * @mastra/[email protected] (prior clean: 1.42.0) * @mastra/[email protected], @mastra/[email protected], @mastra/[email protected] * [email protected], [email protected] * Malicious dependency: [email protected] Immediate action checklist. * Audit dependency trees: npm ls easy-day-js across repos and CI images. * Pin or downgrade every @mastra package to the last provenance-verified release before June 17, 2026. * Treat affected hosts as compromised - do not assume uninstalling node_modules is sufficient. * Rotate secrets: LLM API keys, cloud credentials, npm tokens, GitHub PATs, SSH keys, and database URLs present on infected machines. * Hunt persistence: Windows HKCU\Run (NvmProtocal), macOS ~/Library/NodePackages/protocal.cjs, Linux ~/.config/systemd/nvmconf/. * Block egress to 23.254.164.92 and 23.254.164.123 at firewall/proxy. * Review CI logs for npm install steps between 01:00-03:00 UTC June 17, 2026. Why dependency-only attacks are hard to spot. This campaign highlights a structural gap: package tarballs looked like normal semver bumps from a known maintainer handle, and only one dependency field changed. Typosquats copied dayjs metadata so npm audit and visual lockfile review often showed nothing alarming. Install-time scripts execute before your application imports any @mastra code - so runtime SAST never runs. Teams should enforce provenance attestation requirements, block postinstall scripts in CI where feasible, and monitor registry publishes on scoped packages they depend on. Faq. Did Mastra confirm the incident? Third-party researchers and npm security vendors published detailed analyses June 17; check Mastra's official channels for vendor statements as they emerge. Is this related to Shai-Hulud or node-ipc? No - distinct campaign, distinct payload (easy-day-js typosquat), and distinct access vector (dormant @mastra maintainer token rather than atool or node-ipc maintainer abuse). Can I just delete easy-day-js from node_modules? Not safely. The RAT installs OS persistence outside node_modules; assume full host compromise until forensics clears the machine. Updated 2026-06-19.

Announcing Mastra Harness. Build interactive AI agents with multiple modes, persistent threads, tool approval, and model switching. Jun 18, 2026 Today Mastra is incredibly excited to announce Mastra Harness. Mastra has been working on this for almost six months. The team built MastraCode, a TUI based coding agent Mastra drive every day. Then, Mastra extracted out the best parts into the Harness class for you to build your own harness. Think about the Harness as the layer around the agent loop. It gives you a conversation you can watch, interrupt, and steer; memory suitable for long runs; storage that persists sessions; control over tool calls; task delegation to subagents; and modes you switch between with specialized agents. Let's dive in. The most fundamental concept of Mastra's Harness is the Session that persists state across turns. You can switch between plan and build mode, with per-mode tools, models, and instructions, plus a plan-approval workflow. Manage threads? Yes you can. Harness has a thread lifecycle, you can create, switch, rename, delete, clone. Spawn subagents? Yup, including forking to re-use the cache prefix. Multi-turn? You got it. Harness has a loop with follow-up queuing + steer. Ask users questions? Mastra has a built-in ask_user tool. My personal favorite part is how easy Mastra make it for you to display state to the user. There's a lot going on under the hood, and for that, Harness has a pub/sub event system. It emits 35 signals, under a display_state_changed event type with a state payload and event types like agent_start, tool_input_delta, tool_suspended, subagent_text_delta, follow_up_queued, usage_update, thread_changed. This all reduces into a HarnessDisplayState object which can can be consumed by web, mobile, or TUI, including fields like currentMessage, activeTools, pendingApproval, pendingSuspensions, activeSubagents, tasks etc. You're asking the right question. Early in 2025 Mastra spent a lot of time talking about agents vs LLMs as a spectrum like self-driving cars. Single-turn vs multi-turn, tool calling, loop vs one-shot - all of these were indications you needed an agent, not just an LLM. Now harness vs agent is a similar spectrum. Here are signs you should be using Harness: * If it's supposed to be long-running or autonomous * If it's a colleague you're having long conversations with * If you're sending it off for more than a few minutes to do a task * If it's writing and executing a lot of code, especially in a loop Let's walk through some Harness concerns, then I'll send you over to the docs Here's a quick blurb for getting started. Define a couple different agents, then create a harness with modes: Most agent APIs are one-shot: you send a prompt, the model streams a reply. But the harness keeps the conversation open. You subscribe to a thread once, then send messages in and read everything the agent emits back: every message, tool call, and state change - as a single event stream that stays open for as long as the thread lives. This lets you interrupt a running task, queue a follow-up message, steer it mid-run - and if the process ends, re-attach to the thread and pick up where you left off. Several clients can subscribe to a thread at once - a terminal, a web UI, a Slack bot. More than one person can work with the same agent at the same time. When an agent runs, it emits a stream of low-level deltas - text fragments, reasoning deltas, tool-call starts, tool results. With a standard agent, you have to sort through them to track the current state of the run. With the harness, those deltas are folded into a single display state - collapsing the noise and providing a clearer picture. You can build your UI/TUI around the state - using it to provide user feedback, or ask when input is required. State includes running tools, token usage, pending approvals, subagent activity, memory progress, and more - see the Harness class reference for a full list of state options. A harness holds more state than a single agent run - the conversation history, the active mode, models, token usage, and memory settings. For a long-running agent to survive restarts, crashes or tabs closing, state can't be stored in the running process. The harness preserves state using Mastra's built-in storage - saved using a threadId. Configure a default store and the whole session is persisted. A standard Mastra agent can request approval before a tool runs - for every tool, or just the ones you choose. But it asks again on every call. With a harness, an approval carries across the session. Grant permission for a single tool or a whole category, and the agent won't ask again. Or skip the asking entirely. Flip on YOLO and every tool call just runs. You can still keep one guardrail. Set a tool's policy to deny, and the harness won't ever run it. Approvals gate a tool call, but sometimes the agent needs to pause and ask you a question. The built-in ask_user tool pauses the run, emits a tool_suspended event, and waits for an answer. Add subagents, each with their own instructions, model, tools, and a description of what it does. The harness builds an agent from each and exposes them as a built-in tool. Your running agent - planAgent or executeAgent, the parent - calls that tool mid-task, picking a subagent by its description. By default a subagent is isolated: it inherits none of the parent's context, so it reasons without influence. Here's what that looks like: But sometimes context matters. And when it does, you can set a subagent to forked: true. The harness clones the parent's conversation and runs the subagent as the parent. The model picks up where it left off on a warm prompt cache. A standard agent runs one setup - one set of instructions, one model, one set of tools. To make it plan first and execute second, you'd run two separate agents and wire up the handoff yourself. A mode bundles that setup - an agent and its model - under a name you switch to. Plan and Execute live in the same session. You switch with session.mode.switch, and the conversation carries straight over. A mode can also say where it hands off next. Give the plan a transitionsTo, and once approved the session switches into execute on its own. Finally, the crown jewel: memory. Mastra has talked a lot about why compaction sucks. Mastra's industry-leading Observational memory solves this by keeping structured observations instead of compacting to a lossy summary. As the conversation grows, an observer agent compresses messages into observations; once the observations pile up, a reflector agent condenses them, merging related items while remembering what matters: Harness is available in @mastra/[email protected] or later. Visit the docs to get started. Sam Bhagwat is the founder and CEO of Mastra. He co-founded Gatsby, which was used by hundreds of thousands of developers. A Stanford graduate and veteran of web development, he authored 'Principles of Building AI Agents' (2025).

Mastra launches Agent Builder, an internal agent platform where devs write tools, select models, and build workflows while non-dev teammates assemble agents, chat, and publish — with RBAC, ownership, and visibility controls.