MAL-2026-6050 Malicious code in create-mastra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4da726670223ca28536bc00f5e68f94f22591bdecdb38dd94e5e873fce0afcf2 create-mastra is the Mastra framework's project scaffolder, distributed as a bundled CLI. The flagged signals are generic occurrences of the literal...

MAL-2026-6011 Malicious code in @mastra/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89ab661f926db8827cca977fedce8cae92cf025babad8825c2e43467121a5c26 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6015 Malicious code in @mastra/deployer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ada3444d44067bbe5085e0892f7885b106c016c114676c2601b15bbb52ce4a4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89ab661f926db8827cca977fedce8cae92cf025babad8825c2e43467121a5c26 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5976 Malicious code in cryptodao-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44bcbcde72a12ed60b3d16200226faa40f1e7e66c6ac36776710f2a0a3fec9a7 package.json declares a postinstall hook that runs recon.js on every npm install. recon.js harvests installer-side secrets — AWSSECRETACCESSKEY,...

MAL-2026-10600 Malicious code in @public-for-cdao/api (npm)

The @public-for-cdao/api package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...

Malicious code in @public-for-cdao/common (npm)

The @public-for-cdao/common package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...

MAL-2026-10602 Malicious code in @public-for-cdao/config (npm)

The @public-for-cdao/config package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...

MAL-2026-5960 Malicious code in @mastra/posthog (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68c0b320aa1f49ebdcdd16447b0ac3174bb2a81f46bca2740ca6eaca20f1accd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @mastra/clickhouse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea737d5664a4642538e7e34488a6b0a8df3156828a62e33ada84544a33b214b5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5942 Malicious code in @mastra/clickhouse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea737d5664a4642538e7e34488a6b0a8df3156828a62e33ada84544a33b214b5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/inngest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07e7e7bdee5f91bd1765d633b9afc7567f18b6577502df452ea633f3f71dd9e3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5951 Malicious code in @mastra/inngest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07e7e7bdee5f91bd1765d633b9afc7567f18b6577502df452ea633f3f71dd9e3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/braintrust (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6dc69743b21fec5f3b447419f86b5799d5216e1f1f16d96c8aba930d99514553 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/mongodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 590f8f6b10eff7b7dd626b6e382339b7122f26b43bae2ec5fa02801b0a710638 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/rag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 031ec31035fa78e914e64884be3019150c8f1f77b9c464bce74e63cb0cd13227 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5961 Malicious code in @mastra/rag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 031ec31035fa78e914e64884be3019150c8f1f77b9c464bce74e63cb0cd13227 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5949 Malicious code in @mastra/fastify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ba29e7c4e2320b4f5852c18ded92c92021cfbc47d5bf8146b1a93ffa58260c7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5957 Malicious code in @mastra/mongodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 590f8f6b10eff7b7dd626b6e382339b7122f26b43bae2ec5fa02801b0a710638 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5956 Malicious code in @mastra/mcp-docs-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 477f5b90c17486d7cf04f5aa840c94a66509022040515038a955e610a31c88e4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...