Mastra NPM - setup.cjs Dropping Marker Files

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•1

This rule tracks the process tree where the execution of 'setup.cjs' leads directly to the creation of a '.pkg_history' file. This behavior is indicative of the Mastra NPM supply chain compromise, where malicious packages use 'setup.cjs' to drop marker files for persistence or further stages of the attack.