Mastra NPM - Hex JS File Read by Node and Network Exfil

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•3

This rule detects the combination of a Node.js process reading a JavaScript file with a 24-character hexadecimal filename, immediately followed by outbound network communication to known command and control (C2) IP addresses associated with the 'easy-day-js' campaign. This behavior is indicative of the Mastra NPM supply chain compromise.