create-mastra@1.13.1

Analysis

This release of create-mastra was pushed under a changed publisher account and added a malicious runtime dependency, easy-day-js, a clone/typosquat of the dayjs library (it copies dayjs metadata). easy-day-js@1.11.22 ships a postinstall hook that runs an obfuscated script (setup.cjs) at install time. On install the script disables TLS certificate verification, downloads a second-stage payload over HTTPS from a hardcoded IP endpoint (23[.]254[.]164[.]92:8000, path /update/49890878), writes it to a randomly named .cjs file in the OS temp directory, and launches it with Node as a detached, hidden background process. It also drops marker files (.pkg_history, .pkg_logs) and deletes its own installer script to hide its tracks. This is an install-time remote-code fetch-and-execute dropper delivered via a supply-chain compromise of the create-mastra CLI.