Mastra npm Supply Chain Attack IOCs

Ibrahim Saud@tektrix

•updated Jun 17, 2026•6•1•62

Identifies file, registry, network, and process indicators associated with the @mastra/* npm supply chain compromise. This rule detects the presence of specific malicious files, registry modifications for persistence, outbound network connections to known command and control (C2) infrastructure, and the execution of malicious scripts related to the attack.