Security & Threat Intelligence · 25.07.2026, 15:29 UTC
easy-day-js Targets Mastra, Dependency Attacks Grow
| Schweregrad | info |
|---|---|
| Kategorie | Security & Threat Intelligence |
| Quelle | Sonatype ↗ |
| Veröffentlicht | 25.07.2026 UTC |
Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.
TL;DR On June 17, 2026, security researchers identified a software supply chain attack involving the npm package easy-day-js, a malicious package designed to impersonate the popular JavaScript date library dayjs. Sonatype is tracking this campaign as sonatype-2026-003926. Attackers compromised part of the Mastra AI framework and added easy-day-js as a dependency across a large number of Mastra packages. Once installed, the package used a postinstall script to attempt to download and run a second-stage payload from attacker-controlled infrastructure. This is not a "remove the package and move on" incident. If easy-day-js was installed in a developer workstation, CI runner, build agent, or production-adjacent environment, the host should be treated as compromised until investigated. This campaign also extends a pattern Sonatype researchers tracked in the Axios compromise and Atomic Arch campaign. Attackers are not only publishing malicious packages. They are hijacking trusted packages and using malicious dependencies as the delivery mechanism. Attackers compromised part of the Mastra npm publishing workflow and used that access to add easy-day-js as a dependency across affected Mastra packages. The malicious code did not live directly in the Mastra package source but inside the dependency those packages were updated to install. Sonatype is tracking this trend. In the Axios compromise, attackers introduced a hidden malicious dependency into a trusted npm package. In Atomic Arch, attackers took over orphaned Arch User Repository (AUR) packages and modified build …