Malicious code in @mastra/voice-openai-realtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 623d77007529d1601a2da2b0ff1fc002dfa42282411ba1350b5bc720316d6c0f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6024 Malicious code in @mastra/google-cloud-pubsub (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1bd3f8519d6016a066d4268dae0e9c0d20ca87350cc759832b6053128a5b8d8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/mcp-registry-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45ba997a42d41e72f38a36e0a6122b28388f73eb479dc41f7c1b77b6a75f91c8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6027 Malicious code in @mastra/mcp-registry-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45ba997a42d41e72f38a36e0a6122b28388f73eb479dc41f7c1b77b6a75f91c8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/tavily (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3b560f62205cd42db16500f1d7d8d845fcfe70e261994de22e6d7d1a30b5a95 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6040 Malicious code in @mastra/turbopuffer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d73c50676f96c5af47167ce4405b1f53a38feb3cbd8a3eaf93fe262479680403 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6035 Malicious code in @mastra/s3vectors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a80c7f7a2326cd8139c9d2f5441370092e3816b3f81fda0edbeaa15902ab816a The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6000 Malicious code in @mastra/auth-better-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3f3ba577912ece34e70e0f5d94ee38bf681dc3f0d2a2125d0bbe95c98dbbe3a The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/memory (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bf1631c9f85e46d58c4bf1e6a3a245882a0a13bb756a6dec89c97de5b1a0d04 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6007 Malicious code in @mastra/client-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e455eddde2f8d9fc5c241cf6715800d34191e53b6fd5ddd7f156398755f252e3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in create-mastra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4da726670223ca28536bc00f5e68f94f22591bdecdb38dd94e5e873fce0afcf2 create-mastra is the Mastra framework's project scaffolder, distributed as a bundled CLI. The flagged signals are generic occurrences of the literal...

Malicious code in @mastra/clickhouse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea737d5664a4642538e7e34488a6b0a8df3156828a62e33ada84544a33b214b5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/inngest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07e7e7bdee5f91bd1765d633b9afc7567f18b6577502df452ea633f3f71dd9e3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5962 Malicious code in @mastra/s3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69bd7442a33e88350e5a804e238625a967b16df137b4b1623cd6a0587d25dc21 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/fastembed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3de0aac9c375829f2d4e5e18551958ee9000b1f9237f302c91178e0b52b8746 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5958 Malicious code in @mastra/otel-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07a8b6a73558d739f5ae803c6330009938e0a19f5c6a1a7c0f01cf4884fbea9b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5887 Malicious code in conducts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5fc899376af9cf86b0ddfddeb5e2a904ce8a5109fc293b0c115c1f7e3633fe2d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-5879 Malicious code in ioredis-os (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 387bee0d123eeed248b8be6281784b88d2a3385943a3f696541c1ce48b1c817a ioredis-os appends -os to the widely-used ioredis package name and ships what appears to be a verbatim fork of ioredis same author, same upstream...

MAL-2026-5867 Malicious code in terminal-structured-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14080e4c54ea68f090ab98ee4eb27c7e987fe2d5e7ed6c5bb37ed89504a43099 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-5848 Malicious code in slow-surf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9f66d2ad1de3674c7aa5dd5efdb00624f0d1ff7f6f1ed38f054e6ca018dea673 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...