Malicious code in @mastra/memory (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bf1631c9f85e46d58c4bf1e6a3a245882a0a13bb756a6dec89c97de5b1a0d04 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e88fa7d4c9b877f3fe67c78cbefa1ed49532b4dce6fcefa4963db91a32634ea The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6028 Malicious code in @mastra/memory (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bf1631c9f85e46d58c4bf1e6a3a245882a0a13bb756a6dec89c97de5b1a0d04 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/client-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e455eddde2f8d9fc5c241cf6715800d34191e53b6fd5ddd7f156398755f252e3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6007 Malicious code in @mastra/client-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e455eddde2f8d9fc5c241cf6715800d34191e53b6fd5ddd7f156398755f252e3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in create-mastra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4da726670223ca28536bc00f5e68f94f22591bdecdb38dd94e5e873fce0afcf2 create-mastra is the Mastra framework's project scaffolder, distributed as a bundled CLI. The flagged signals are generic occurrences of the literal...

MAL-2026-6011 Malicious code in @mastra/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89ab661f926db8827cca977fedce8cae92cf025babad8825c2e43467121a5c26 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/deployer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ada3444d44067bbe5085e0892f7885b106c016c114676c2601b15bbb52ce4a4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5982 Malicious code in metrics-probe-77d4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d079b30dbb30db1a61acddcd094d2e7e67e7ef466d624e4ad2392edc9d9203e On install, package.json runs postinstall: node run.js. run.js imports os, fs, http, https, and childprocess and at runtime collects host identifiers...

MAL-2026-5984 Malicious code in nepublisher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fc0d0609f88630f7ce36adf18c70a1d6bd3d64aaaa059a3b8ec9b97b813705a On npm install, lib/init.js spawns a detached Node child process that collects host identifiers hostname, username, cwd, IPv4 addresses, Node version...

MAL-2026-5988 Malicious code in params-valid-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 397af72237ba3626ac4727497662530f602c2ce6ec71406f48b508055687366c The package presents itself as 'Simplified HTTP request client' and copies identity metadata from Mikeal Rogers' legitimate request package bugs URL...

MAL-2026-5989 Malicious code in pathfix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2527fa3618f01b694722f2a50297c248053dcdabf1b471ee9bdbdc6522bb838 pathfix presents itself as a Stylus port of normalize.css but ships a copy of the unrelated normalize-path module with an appended...

MAL-2026-10603 Malicious code in @public-for-cdao/token (npm)

The @public-for-cdao/token package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...

Malicious code in cryptodao-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5323b2fc30e7603b402729f45345a9c3eb4af8361acaca5d035cc51f9e660cea package.json declares postinstall: node recon.js, which fires automatically on npm install. recon.js enumerates installer-side secrets —...

Malicious code in cryptodao-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03ac58e81310f19b32d136445eab91f7ddc776921ff8dfd08bdb91bcdd4a1da6 [email protected] ships a postinstall script recon.js that runs automatically on npm install and harvests installer-side secrets. The script...

MAL-2026-5960 Malicious code in @mastra/posthog (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68c0b320aa1f49ebdcdd16447b0ac3174bb2a81f46bca2740ca6eaca20f1accd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @mastra/clickhouse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea737d5664a4642538e7e34488a6b0a8df3156828a62e33ada84544a33b214b5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5942 Malicious code in @mastra/clickhouse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea737d5664a4642538e7e34488a6b0a8df3156828a62e33ada84544a33b214b5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/inngest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07e7e7bdee5f91bd1765d633b9afc7567f18b6577502df452ea633f3f71dd9e3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5951 Malicious code in @mastra/inngest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07e7e7bdee5f91bd1765d633b9afc7567f18b6577502df452ea633f3f71dd9e3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...