Mastra npm Supply Chain Compromise - Hidden Tracking File Creation

Ethan Andrews@eandrews

•updated Jun 18, 2026•3•0•30

Detects the creation of hidden tracking files (.pkg_history and .pkg_logs) in the system's temporary directory. These markers are dropped by the setup.cjs dropper as part of the easy-day-js typosquat in the Mastra npm supply chain compromise.