Mastra NPM - Node Executing 24-Hex JS from Temp

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•1

This rule detects Node.js processes executing JavaScript files with exactly 24 hexadecimal characters in their filename from temporary directories (temp or tmp). This pattern is associated with the Mastra NPM supply chain compromise.