From package to postinstall payload: Inside the Mastra npm supply chain compromise

A sophisticated supply chain attack on the Mastra npm ecosystem leveraged a compromised maintainer account to inject a malicious dependency into over 140 packages, enabling stealthy postinstall malware execution that threatened developer workstations, CI/CD environments, and downstream software integrity.