@mastra/node-speaker@0.1.1

Analysis

This version is a hijacked re-publish of a previously-dormant native audio package (the prior release was clean; this one was pushed under a newly-changed, anonymous publisher account after ~15 months of inactivity). The only change from the last good version is an injected dependency on a date-library typosquat (easy-day-js). That dependency ships a postinstall hook that runs an obfuscated dropper: it disables TLS certificate verification, drops marker files in the user home directory, downloads a second-stage payload over HTTPS from a hardcoded raw-IP command-and-control server (23[.]254[.]164[.]92 on port 8000), writes it to a randomly-named .cjs file in the home directory, launches it as a detached background Node process, and then deletes its own installer script to hide evidence. Installing this package therefore results in remote code execution at install time via the transitive dependency.