Mastra NPM Supply Chain Attack Detection

Thiru N@Iamthiru

•updated Jun 17, 2026•1•0•7

This rule detects the execution of specific Node.js scripts (`setup.cjs` or `protocal.cjs`) that are associated with the Mastra npm supply chain attack. It identifies Node.js process executions across Windows, macOS, and Linux, looking for these malicious script names in the command line.