Node.js Spawning Detached Hex-Named JS in Temp Directory (Mastra Attack)

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•3

Detects a Node.js process spawning a detached JavaScript file with a randomly generated 24-character hexadecimal filename in a temporary directory. This behavior is indicative of the stage-2 payload execution observed in the Mastra npm supply chain attack (easy-day-js typosquat).