Hostile 92% javascript Download

@mastra/turbopuffer 1.0.3

Trojanized dependency easy-day-js

Package carries easy-day-js stealer dependencyRepublished manifest injects unused dependency
SHA-256123a0a10c3cd45a74d3c3b5da653f4730a7d9ea7fe7a734a6ac3e5effd95df52
URLhttps://registry.npmjs.org/@mastra/turbopuffer/-/turbopuffer-1.0.3.tgz
MaleculeK(Am₂)O(S₂)H₂(DbOs)Md(Pa₇)

Also flagged by osv (MAL-2026-6040: Malicious code in @mastra/turbopuffer (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.