Mastra NPM - Hex JS File Drop followed by .pkg Marker Drop

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•6

This rule detects the dropping of a 24-character hexadecimal JavaScript payload followed by the creation of a '.pkg_history' or '.pkg_logs' marker file within a one-minute timeframe. This behavior is indicative of the Mastra NPM supply chain compromise.