PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Over 140 popular Mastra npm Packages Hit by Supply Chain Attack

aikido.dev | incident | #ai-security | #supply-chain | #open-source | #malware | #npm | #aikido | #ai-agents | #supply-chain-attack | #mastra | #crypto-theft | #postinstall | #wallet-theft | #crypto-wallets | #crypto-wallet-theft | #crypto-wallet-stealer | #dayjs
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Aikido detected an attack republishing 141 @mastra npm packages with a malicious dayjs clone, easy-day-js, whose postinstall hook deploys a payload targeting 160+ browser crypto wallets.
Published
Collected

Related coverage

incident · wiz.io
Miasma: Supply Chain Attack Targeting RedHat npm Packages
Wiz Research found Miasma, a supply-chain attack on @redhat-cloud-services npm: 32+ tampered releases (~80k weekly downloads) carried a Shai-Hulud-derived payload targeting GCP and Azure identities.
blog · aikido.dev
Aikido launches external network pentesting
TL;DR: Aikido now pentests your external network. Attackers already test your perimeter every day, and with AI agents doing the grunt work, they're faster than ever. Now you can run the same test first. Give our agents one domain and they'll map the internet-facing systems you run and attack them from the outside, exactly like a malicious actor would.
blog · aikido.dev
Adding Aikido AI pentesting to your existing security stack
How to add Aikido's AI pentesting on top of the SAST, SCA and cloud tools you already run, from your first pentest through whitebox testing, continuous testing and remediation.
Critical · vulnerability · aikido.dev
Node2Shell Evolves to HTTP2Shell: Google Brotli Flaw (CVE-2026-111497) Affects HTTP Ecosystem
Brotli is ubiquitous across the modern HTTP ecosystem for web asset compression. Because the flaw allows unauthenticated remote code execution in both directions, any service or client automatically decompressing untrusted Brotli payloads is at critical risk until patched.
blog · aikido.dev
LiteLLM compromised again: infostealer and RAT found in version 1.107.0
# LiteLLM compromised again: infostealer and RAT found in version 1.107.0 Written by Ilyas Makari Published on: Oct 21, 2026 On October 21, 2026, version 1.107.0 of LiteLLM (a popular open source...
blog · aikido.dev
tensorlake NPM package compromised with Shai Hulud worm
# tensorlake NPM package compromised with Shai Hulud worm Written by Oliver Smith Published on: Oct 8, 2026 On 8 October 2026 a threat actor published a compromised version of tensorlake to npm....
Back