Node.js Malicious Script Execution (Mastra npm Supply Chain Compromise)

Ethan Andrews@eandrews

•updated Jun 18, 2026•5•0•35

Detects Node.js executing the malicious setup.cjs script with the --no-warnings flag. This execution sequence is associated with the easy-day-js typosquat postinstall hook used in the Mastra npm supply chain compromise.