easy-day-js Mastra npm Supply Chain: node.exe spawning setup.cjs postinstall

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects the execution of a suspicious 'setup.cjs' script via Node.js triggered during an 'npm install' process, characteristic of the malicious payload delivery mechanism found in compromised Mastra packages. The rule specifically monitors for Node.js spawning a process with command-line arguments including 'setup.cjs' and the '--no-warnings' flag.