Mastra NPM - Detached Hex Execution to 23.254 Network

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•1

Correlates the execution of a JavaScript file with a 24-hex-character name (e.g., 'a1b2c3d4e5f6a7b8c9d0e1f2.js') with an active outbound network connection to the 23.254.164.x subnet. This pattern is indicative of the Mastra NPM supply chain compromise, where malicious JavaScript is executed and attempts to communicate with a command and control server.