Skip to content

Security: k9securityio/example-agent-mastra

Security

SECURITY.md

Security posture

The easy-day-js Mastra supply-chain incident (2026-06-17)

A hijacked former-contributor npm account (ehindero, scope access never revoked) republished ~141 @mastra/* packages in a tight window on 2026-06-17, ~01:12–02:39 UTC. The package code was not modified; instead each got a malicious dependency, easy-day-js (a dayjs typosquat), whose postinstall dropper disables TLS verification and fetches a cross-platform infostealer that harvests environment variables (LLM/cloud credentials), browser data, and crypto-wallet extensions, exfiltrating to a C2.

Known-malicious republishes include @mastra/core@1.42.1, @mastra/mcp@1.10.1, @mastra/schema-compat@1.2.12, @mastra/memory@1.20.4, mastra@1.13.1, and the rest of the ~141. Post-incident versions (1.43.x–1.45.x) are not confirmed clean by public sources and are deliberately not used here.

Pinned clean versions

Package Version Published Publisher easy-day-js?
@mastra/core 1.42.0 2026-06-12 GitHub Actions (OIDC) none
@mastra/mcp 1.10.0 2026-06-12 GitHub Actions (OIDC) none
@mastra/schema-compat 1.2.11 (transitive, overridden) pre-incident — none

These are the last clean releases before the attack window, both OIDC-published. Published npm versions are immutable, so these artifacts are trustworthy.

Controls in this project (do not loosen without re-vetting)

  1. .npmrc before=2026-06-16T23:59:59.999Z — the resolver ignores every version published on/after June 17, tree-wide. The malicious republishes are invisible to it.
  2. Exact pins + committed package-lock.json + npm ci — the lockfile (exact versions + integrity hashes) is the install-time allowlist. After the first vetted install, all installs are npm ci.
  3. overrides — forces @mastra/schema-compat to the clean 1.2.11, blocking a transitive bump.
  4. .npmrc ignore-scripts=true / npm install --ignore-scripts — neutralizes the postinstall dropper vector regardless of what resolves. Viable because the runtime needs no native postinstall (Node 24 native TS; no tsx/esbuild).
  5. No secrets needed for the core validation — list-tools and score need no model API key, so the tool-connection proof runs without credentials in the environment (the infostealer's target).
  6. Telemetry disabled — MASTRA_TELEMETRY_DISABLED=1 keeps the example from phoning home.

Known npm audit findings (benign)

The pinned tree reports 4 advisories (1 low, 3 moderate; 0 high, 0 critical): a quadratic-complexity DoS in js-yaml merge-key handling (via gray-matter → @mastra/core) and an uncontrolled-resource-consumption issue in @ai-sdk/provider-utils. These are DoS-class issues in code paths this example does not exercise (we don't parse untrusted YAML), their only fixes are in post-2026-06-17 versions excluded by the before-floor, and none is easy-day-js. Accepted; re-evaluate if a clean post-incident Mastra line is verified.

Verify a clean install

npm ls easy-day-js                       # MUST be empty
grep -i easy-day-js package-lock.json    # MUST find nothing
npm audit signatures                     # registry signature verification

Sources

There aren't any published security advisories