Mastra supply-chain attack · June 2026

Are you exposed to the easy-day-js dropper?

The Mastra incident backdoored up to 144 AI packages via a typosquat of dayjs whose postinstall hook fetched a Node RAT. Paste your package.json below — we check every dependency for typosquats, known-malicious names, and (when the scanner is reachable) live trust scores. Your file is analyzed in-memory and never stored.