Why The Mastra Packages Were Clean And Still Shipped Malware

On June 17, 2026, an attacker used a hijacked former maintainer account to republish more than 140 Mastra npm packages in roughly 88 minutes. The library code was untouched. Every release carried one extra line in package.json, a dependency on easy-dayjs, a typosquat of dayjs published a day earlier as a working clone and switched to a weaponized version 11 minutes before the sweep began. That one line delivered a cross-platform info stealer and crypto wallet thief during npm install, before any application imported anything, which is why reading the named package's source would miss it. In this live stream, we trace the timeline, explain how a caret range turned a decoy into a dropper, and show what to check in lock files and CI runners.