GHSA Malware advisory is missing some packages of Mastra supply chain attack campaign
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 45/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- javascript, node.js
- Domain
- security
Research direction
Open the Mastra provider changeset URL and compare its package/version list with the current GHSA advisory. Check the cited supply-chain reports for corroboration of the additional packages. Done means the advisory accurately reflects all verified affected packages and versions; no repository file or test is named in the issue.
Written by the indexing model from the issue text.
Description
Hi,
Please, review better the current malware campaign for Mastra packages are missing in the GHSA advisory.
Take a look to this URL from the provider:
https://github.com/mastra-ai/mastra/blob/main/.changeset/easy-day-js-security-remediation.md?plain=1
Missing packages example (and probably more):
| Package | Version |
|---|---|
| @mastra/acp | 0.2.2 |
| @mastra/agentcore | 0.2.2 |
| @mastra/agentfs | 0.1.1 |
| @mastra/arthur | 0.3.3 |
| @mastra/astra | 1.0.2 |
More references:
- https://thehackernews.com/2026/06/144-mastra-npm-packages-compromised-via.html
- https://www.stepsecurity.io/blog/mastra-npm-packages-compromised-using-easy-day-js
- https://socket.dev/blog/mastra-npm-packages-compromised
- https://socket.dev/supply-chain-attacks/mastra-ai-framework-compromise
- https://safedep.io/mastra-npm-scope-takeover-supply-chain-attack/
- Dominant language
- No language data
- Stars
- 2.5k
- Forks
- 772
- Avg merge
- 3d 15h
- Merged PRs (30d)
- 46
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from github/advisory-database
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
github/advisory-database#9255 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
github/advisory-database#9164 · 1 reaction ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
github/advisory-database#8994 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
github/advisory-database#8898 · 4 comments · 1 reaction ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
github/advisory-database#8841 ·
All issues in github/advisory-database
Similar issues
-
needs-triage
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Nmap
Difficulty 1/5 Under an hour Newbie friendliness 85/100
-
Mend: dependency security vulnerability untriaged
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
blocklist removal
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
MetaMask/eth-phishing-detect#296544 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Azure/azure-functions-docker#1257 ·