Mastra npm supply-chain compromise distributes malicious packages

Mastra reported that a maintainer was compromised through social phishing and that a token associated with the account was used on 16 June 2026 to publish 116 malicious npm packages containing a credential-exfiltrating post-install payload. All affected versions were unpublished or deprecated by 23:57 PT and safe replacements followed. Microsoft later attributed the campaign with high confidence to Sapphire Sleet.