Sapphire Sleet - Mastra Package Dependency Injection

Georg Lauenstein@gsec

•updated Jun 21, 2026•0•0•8

Detects npm operations involving compromised Mastra packages that were injected with the malicious easy-day-js dependency. Sapphire Sleet published 140+ poisoned versions across the @mastra scope, each containing easy-day-js as a new dependency to enable supply chain compromise.