MAL-2026-6041 Malicious code in @mastra/upstash (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 109a798f50c4d4a1e3d840f494f4febeee6911daa9b2ecb5d1a6dfd7369a96c9 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/s3vectors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a80c7f7a2326cd8139c9d2f5441370092e3816b3f81fda0edbeaa15902ab816a The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/chroma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a18696e99554013ec1bb0d7a66c97f48ee65edc6cc6f8f2d4f6c9e26d88268fe The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6005 Malicious code in @mastra/chroma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a18696e99554013ec1bb0d7a66c97f48ee65edc6cc6f8f2d4f6c9e26d88268fe The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/couchbase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 693f6ba494800c38ce77ad49fa5d74745125fc4d3bb68c047ea96032580b7a93 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/cloudflare-d1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2cc557711d8e72038426bf1e85e5225dd60e975b4dc7d3d0be59300abaac844 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/auth-auth0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05fc4efe1a6db0606009fd2ff413d54c78874eec38e20ca1a3dbb3ee053fc734 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/auth-workos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fda21074dd42e87b39d51daa2005f7387067b9d8cd59742a05eec6515e40643 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6003 Malicious code in @mastra/auth-workos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fda21074dd42e87b39d51daa2005f7387067b9d8cd59742a05eec6515e40643 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6020 Malicious code in @mastra/dsql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47553f7ae35dba96de01f34980d8270e1820fd691106ad98ad4650087778d176 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/mssql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8a702cd09bcdbaf0d5d7a27cf0d433f1a8b3cec76cb044365ebe71c1655b31e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6029 Malicious code in @mastra/mssql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8a702cd09bcdbaf0d5d7a27cf0d433f1a8b3cec76cb044365ebe71c1655b31e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6001 Malicious code in @mastra/auth-clerk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d80aa3e2beb7b80c5c0ab6155ebf33290b48d7e23a97f7dc5e2f7bc288d5e84f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6022 Malicious code in @mastra/express (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9cd00df32d6d56cd3d4996965ed13e18c1da3a9b0007392b4fc14da1a8fcbb46 The package's bundled distribution files dist/index.cjs and dist/index.js contain a Buffer.from..., 'base64'.toString'utf-8' decode pattern. This...

Malicious code in @mastra/nestjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cce4b38ce42c23095f722a3fd011dcd5070230e430bd5ef2be73c0eb943f79d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6036 Malicious code in @mastra/server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e88fa7d4c9b877f3fe67c78cbefa1ed49532b4dce6fcefa4963db91a32634ea The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6028 Malicious code in @mastra/memory (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bf1631c9f85e46d58c4bf1e6a3a245882a0a13bb756a6dec89c97de5b1a0d04 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/client-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e455eddde2f8d9fc5c241cf6715800d34191e53b6fd5ddd7f156398755f252e3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6011 Malicious code in @mastra/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89ab661f926db8827cca977fedce8cae92cf025babad8825c2e43467121a5c26 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5960 Malicious code in @mastra/posthog (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68c0b320aa1f49ebdcdd16447b0ac3174bb2a81f46bca2740ca6eaca20f1accd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...