GCVE-110-OSM-2026-6217

@mastra/engine@0.1.1 was trojanized in the coordinated supply chain attack on the @mastra npm organization on 2026-06-17 (01:12-02:24 UTC). A compromised maintainer account published this version with an injected dependency on easy-day-js@^1.11.21, which resolves to the weaponized easy-day-js@1.11.22 whose postinstall dropper (setup.cjs) disables TLS, fetches a remote payload from C2 23.254.164.92:8000, spawns a persistent detached process, and self-deletes. Released without SLSA provenance attestations. Malicious payload delivered via injected dependency easy-day-js@^1.11.21 (resolves to weaponized easy-day-js@1.11.22). Postinstall hook: "node setup.cjs --no-warnings" Dropper file: setup.cjs (4,572 bytes) Behavior: sets NODE_TLS_REJECT_UNAUTHORIZED=0 to disable TLS validation, fetches second-stage payload from C2 at https://23.254.164.92:8000/update/49890878, writes it to a randomly named temp file, spawns a persistent detached Node process, then self-deletes. Stage-1 C2: 23.254.164.92:8000 | Stage-2 C2: 23.254.164.123:443 Beacon files: <tmpdir>/.pkg_history, <tmpdir>/.pkg_logs Compromised maintainers: sergey2016 (sergey2016@tutamail.com), ehindero (ehindero2016@tutamail.com)