Node Suspicious Setup Execution

nomit vyas@xoxo

•updated Jun 25, 2026•0•0•5

Detects Node.js executing the malicious setup.cjs script with the --no-warnings flag. This execution sequence is associated with the easy-day-js typosquat postinstall hook used in the Mastra npm supply chain compromise.