Mastra NPM - Multiple Node Processes to Malicious IPs

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•1

Detects if multiple distinct node.exe processes attempt to connect to known easy-day-js C2 IPs within a short span, indicating potential compromise related to the Mastra NPM supply chain attack.