Node Suspicious Setup Execution

Ibrahim Saud@tektrix

•updated Jun 18, 2026•8•1•49

Detects Node.js executing the malicious setup.cjs script with the --no-warnings flag. This execution sequence is associated with the easy-day-js typosquat postinstall hook used in the Mastra npm supply chain compromise.