TI Mindmap HUB
Threat Intelligence Report

easy-day-js: Supply Chain Campaign Targets Mastra npm Packages

📅 June 18, 2026 📰 research.jfrog.com 🔍 0 CVE(s) referenced

A supply chain attack stealthily compromised over 140 Mastra npm packages by injecting a malicious dependency, easy-day-js, which masqueraded as a harmless date library but delivered a persistent Node.js backdoor via an obfuscated postinstall script.

vendor

Sign in to access the full report including:
detailed analysis, IOCs, MITRE ATT&CK mapping, and STIX bundle.

🔐 Sign In to Read Full Report

You'll need to accept our Terms of Service to access the platform.

📊 Visual Mindmap
🎯 IOC Extraction
⚔️ MITRE ATT&CK TTPs
📦 STIX 2.1 Bundle