One Hijacked Account Exposes 144 Mastra Packages in npm Supply Chain Crisis

A single compromised npm contributor account enabled the rapid distribution of malicious code across 144 Mastra packages, exposing developers, enterprises, and AI-focused projects to potential data exfiltration and persistent backdoors. This attack underscores how vulnerable open-source ecosystems are to credential-based threats and why traditional dependency scanning approaches fall short in detecting fast-moving supply chain compromises.