144 Mastra Packages Weaponized in npm's Largest Targeted Supply Chain Attack

The compromise of 144 Mastra npm packages represents one of the JavaScript ecosystem's largest targeted supply chain attacks, directly threatening AI application development infrastructure. Exploiting a single hijacked npm account, attackers distributed malicious code at scale while bypassing normal review mechanisms, exposing a fundamental vulnerability in open-source's trust model. Developers must immediately audit Mastra dependencies and implement verification mechanisms to prevent similar mass-poisoning incidents.