Blog Alina Podoba

Alina Podoba Security Research Analyst

Mastra npm Scope Takeover: 140+ Packages Compromised via easy-day-js Dropper - @Mastra

Mastra npm Scope Takeover: 140+ Packages Compromised via easy-day-js Dropper

Alina Podoba Jun 17, 2026

Malicious Packages

@Mastra npm: 140+ Packages Compromised

Mastra npm Scope Takeover: 140+ Packages Compromised via easy-day-js Dropper - Shai Hulud Miasma

Miasma: Red Hat Cloud Services npm Packages Hit by a Mini Shai-Hulud-Style Campaign

Alina Podoba Jun 1, 2026

Malicious Packages

npm packages in @redhat-cloud-services drop a multi-stage cloud credential stealer.

Mastra npm Scope Takeover: 140+ Packages Compromised via easy-day-js Dropper - Blog Cover Threat news

Laravel-Lang Composer tag-rewrite Supply Chain Attack

Alina Podoba May 22, 2026

Malicious Packages

Four Laravel-Lang Composer packages were poisoned via tag rewrite.

Mastra npm Scope Takeover: 140+ Packages Compromised via easy-day-js Dropper - Mini Shai Hulud is Back 1

Mini Shai-Hulud Hits @antv: 323 npm Packages Compromised Through the atool Maintainer Account

Alina Podoba May 19, 2026

Malicious Packages

Mini Shai-Hulud strikes again: 323 npm packages compromised via @antv's atool.