From package to postinstall payload: Inside the Mastra npm supply chain compromise

From package to postinstall payload: Inside the Mastra npm supply chain compromise A poisoned npm package infected 140+ projects with a hidden payload. This report highlights how to detect, hunt, and defend against supply chain attacks using Microsoft Defender and actionable threat intelligence. The post From package to postinstall payload: Inside the Mastra npm supply chain compromise appeared first on Microsoft Security Blog . In this article Attack chain overview Discove…

https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise

sha256:d5e3dc8e482f94cd87babad94e0b1f195eccc2146b8d760f1f82ad87ecbd4931

• cve0
• md50
• url1
• ipv42
• ipv60
• sha10
• domain23
• sha2565
• malware_token0
• attack_pattern0
• threat_actor_token0