dayjs

On June 17, 2026, an attacker compromised the @mastra npm organization and added the typosquat package easy-day-js as a dependency across 140+ Mastra AI framework packages, exposing over 1.1 million w…

An attacker hijacked a Mastra maintainer's account and republished 116 packages in the @mastra catalog over 27 minutes, adding a hidden dependency on the typosquat package easy-day-js. The malicious p…