Supply Chain Incidents

MAL-2026-6029

Malicious code in @mastra/mssql (npm)

MAL-2026-6002

Malicious code in @mastra/auth-supabase (npm)

MAL-2026-6001

Malicious code in @mastra/auth-clerk (npm)

MAL-2026-6025

Malicious code in @mastra/koa (npm)

MAL-2026-6022

Malicious code in @mastra/express (npm)

MAL-2026-6030

Malicious code in @mastra/nestjs (npm)

MAL-2026-6028

Malicious code in @mastra/memory (npm)

MAL-2026-6036

Malicious code in @mastra/server (npm)

MAL-2026-6007

Malicious code in @mastra/client-js (npm)

MAL-2026-6011

Malicious code in @mastra/core (npm)

MAL-2026-6015

Malicious code in @mastra/deployer (npm)

MAL-2026-6050

Malicious code in create-mastra (npm)

MAL-2026-5981

Malicious code in metrics-probe-64b2 (npm)

MAL-2026-5982

Malicious code in metrics-probe-77d4 (npm)

MAL-2026-5983

Malicious code in metrics-probe-dc85 (npm)

MAL-2026-5990

Malicious code in pkg-telemetry-r4f9 (npm)

MAL-2026-5992

Malicious code in runtime-metrics-w7k2 (npm)

MAL-2026-5986

Malicious code in npm-sandbox-ping-r9t2 (npm)

MAL-2026-5980

Malicious code in gpu-accelerator (npm)

MAL-2026-5972

Malicious code in canary-ci-test (npm)

MAL-2026-5984

Malicious code in nepublisher (npm)

MAL-2026-5994

Malicious code in ts-webplug (npm)

MAL-2026-5988

Malicious code in params-valid-js (npm)

MAL-2026-5995

Malicious code in tobihook (PyPI)