SlowMist: Over 140 Mastra npm packages suffer from supply chain attacks, posing security risks
Foresight News reports, according to SlowMist monitoring, a coordinated supply chain attack targeting more than 140 npm packages is underway. The affected packages automatically add a dependency on easy-day-js@^1.11.21 during installation, which resolves to the malicious version easy-day-js@1.11.22. This triggers attacker-controlled code via installation hooks.
Potential attacker behaviors include: executing code upon installation, maintaining persistence on Windows/macOS/Linux, collecting browser history, inventorying cryptocurrency wallet extensions, exposing credentials or CI keys through subsequent operations, and leaking data.
For any systems that have installed affected versions, consider them as potentially compromised: remove the malicious version and easy-day-js, delete node_modules and package caches, reinstall known clean versions (using verified lock files), isolate affected hosts, preserve logs, remove persistence traces, and rotate npm, GitHub, cloud service, SSH/Git, CI/CD, and wallet-related credentials if exposure is possible.
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
Evogene announces special shareholder meeting
Evogene will hold a special general meeting of shareholders in Rehovot, Israel on Nov. 10, 2026. Shareholders will vote on electing Oz Adler and Dr. Adi Zuloff-Shani to the board. Ballots will also cover the election of Itay Maroz and Shahar Zadok, subject to approval of a cooperation agreement. The meeting will also vote on a cooperation agreement between Evogene and L.I.A. Pure Capital and Invest-Pro Shukai Hon. Disclaimer: This news brief was created by Public Technologies (PUBT) using generative artificial intelligence. While PUBT strives to provide accurate and timely information, this AI-generated content is for informational purposes only and should not be interpreted as financial, investment, or legal advice. Evogene Ltd. published the original content used to generate this news brief via EDGAR, the Electronic Data Gathering, Analysis, and Retrieval system operated by the U.S. Securities and Exchange Commission (Ref. ID: 0001178913-26-004722), on October 06, 2026, and is solely responsible for the information contained therein.
UK names 6 banks to lead first digitally native government bond
Altaris Completes Acquisition of Simulations Plus
02:57 PM EDT, 10/06/2026 (MT Newswires) -- Simulations Plus (SLP) said Tuesday that affiliates of Altaris have completed the acquisition of the company. The transaction price was $375 million, with each Simulations shareholder receiving $18.50 in cash per share, according to an earlier statement. As a result of the acquisition, Simulations said it has become a privately held company and its common stock will no longer trade on the Nasdaq Global Select Market.
Ondo Finance brings pre-IPO AI exposure on-chain — But there’s a catch
Crypto prices
More
