Supply Chain Incidents

MAL-2026-6035

Malicious code in @mastra/s3vectors (npm)

MAL-2026-6010

Malicious code in @mastra/convex (npm)

MAL-2026-6042

Malicious code in @mastra/vectorize (npm)

MAL-2026-6034

Malicious code in @mastra/qdrant (npm)

MAL-2026-6005

Malicious code in @mastra/chroma (npm)

MAL-2026-6012

Malicious code in @mastra/couchbase (npm)

MAL-2026-6009

Malicious code in @mastra/cloudflare-d1 (npm)

MAL-2026-6000

Malicious code in @mastra/auth-better-auth (npm)

MAL-2026-5999

Malicious code in @mastra/auth-auth0 (npm)

MAL-2026-6003

Malicious code in @mastra/auth-workos (npm)

MAL-2026-6020

Malicious code in @mastra/dsql (npm)

MAL-2026-6029

Malicious code in @mastra/mssql (npm)

MAL-2026-6002

Malicious code in @mastra/auth-supabase (npm)

MAL-2026-6001

Malicious code in @mastra/auth-clerk (npm)

MAL-2026-6025

Malicious code in @mastra/koa (npm)

MAL-2026-6022

Malicious code in @mastra/express (npm)

MAL-2026-6030

Malicious code in @mastra/nestjs (npm)

MAL-2026-6028

Malicious code in @mastra/memory (npm)

MAL-2026-6036

Malicious code in @mastra/server (npm)

MAL-2026-6007

Malicious code in @mastra/client-js (npm)

MAL-2026-6011

Malicious code in @mastra/core (npm)

MAL-2026-6015

Malicious code in @mastra/deployer (npm)

MAL-2026-6050

Malicious code in create-mastra (npm)

MAL-2026-5981

Malicious code in metrics-probe-64b2 (npm)