Mastra npm package compromised, delivering malicious payload to 140+ projects
A malicious npm package named Mastra was discovered to contain hidden code that executed during installation, compromising over 140 dependent projects. The attack leveraged postinstall scripts to deliver unauthorized payloads to developers and organizations relying on this supply chain component. Microsoft Security provides detection guidance and threat hunting techniques to identify compromised systems.
Why it matters in Western Canada: Canadian post-secondary institutions, tech companies, and government agencies using npm-dependent applications and Microsoft 365 environments face direct exposure to supply chain compromises. Detecting and remediating poisoned dependencies is critical for organizations across BC, Alberta, Saskatchewan, and Manitoba.
Summary generated from the original advisory. Read the full source: msft-security
- Source
- https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/
- CVEs
- None listed
- Tags
- npm, supply-chain, mastra, postinstall, malware
- Provenance
- mask2-ti-pipeline (AI-assisted, human-reviewable)