An attacker reused a dormant former Mastra contributor npm account to republish 143 @mastra packages on June 17, 2026, adding a dependency on easy-day-js that resolved to a malicious postinstall version. The dropper fetched a second-stage Node RAT from Hostwinds infrastructure, installed persistence across macOS, Linux, and Windows, and targeted browser profiles for cryptocurrency wallet extensions and other host data. SafeDep did not confirm attribution, but noted close tradecraft overlap with the Axios npm compromise attributed by Microsoft to Sapphire Sleet.