An attacker compromised the @mastra npm organization and republished more than 140 Mastra ecosystem packages with a dependency on the typosquatted `easy-day-js` package. The malicious `[email protected]` release used a postinstall dropper to disable TLS validation, download a second-stage payload from `23.254.164.92:8000`, run it in the background with `23.254.164.123:443` as C2, and delete its own dropper file. StepSecurity observed the behavior in a controlled GitHub Actions run and blocked the stage-two download with Harden Runner, preventing follow-on execution and likely credential exfiltration from developer or CI environments.