Hackers Compromised 140+ Mastra npm Packages to Deploy Password-Stealing Malware

A sophisticated supply chain attack has targeted the Mastra-AI npm ecosystem, with researchers from Microsoft and Socket identifying over 141 compromised packages designed to silently deploy an infostealer payload on developer machines, CI/CD runners, and build environments. The campaign, detected on June 17, 2026, exploited a typosquatting dependency to deliver multi-stage malware capable of stealing […]

The post Hackers Compromised 140+ Mastra npm Packages to Deploy Password-Stealing Malware appeared first on Cyber Security News.