The ehindero npm account, belonging to a legitimate former Mastra contributor, was compromised by an attacker who still had publish access to the entire @mastra scope despite having gone dormant since late 2024 or early 2025. On June 16, 2026 at 07:05 UTC, the attacker published a clean, fully functional copy of a package called easy-day-js, a deliberate impersonation of the popular dayjs date library, with no malicious code, establishing a benign version history. The following day, June 17 at 01:01 UTC, the attacker published easy-day-js version 1.11.22, identical in its core code but adding a postinstall hook that executes an obfuscated dropper script.
Eleven minutes later, the attacker began an automated publishing campaign using the compromised account, republishing more than 140 packages across the Mastra scope, including the high profile @mastra/core package with roughly 918,000 weekly downloads, each with easy-day-js silently added as a production dependency. The entire campaign ran for approximately 88 minutes. Because the dependency was specified with a caret range, any system that ran npm install against an affected Mastra package automatically resolved to the weaponised version of easy-day-js.
The postinstall hook disabled TLS certificate validation, downloaded a second stage payload from attacker controlled infrastructure, executed it as a detached background process, and deleted itself to minimise forensic traces. Researchers at Snyk, Socket, JFrog, Microsoft, and several other security vendors detected the campaign within minutes of publication. Microsoft Threat Intelligence shared its findings with the npm security team, the malicious package versions were removed, and the attacker's publish access to the @mastra scope was revoked. Mastra's maintainers responded the same day, forward rolling 142 publishable packages with clean versions.
- Check for the presence of easy-day-js in node_modules or package-lock.json files across all projects and CI/CD environments. Any match indicates the system ran an install against a compromised version.
- Treat any developer workstation, CI runner, or build environment that ran npm install or npm update against a Mastra package on or after June 16, 2026 as compromised, regardless of whether the package was later imported or used.
- Rotate npm tokens, cloud provider keys, AI model provider API keys, CI/CD secrets, and SSH credentials on any affected system.
- Roll back to a clean Mastra version: mastra and create-mastra 1.13.0 or earlier, @mastra/core 1.42.0 or earlier, and run installs with the ignore scripts flag while validating dependency trees going forward.
Microsoft published an advisory on June 16, 2026 acknowledging an elevation of privilege vulnerability in the Microsoft Malware Protection Engine, publicly known as RoguePlanet, and assigning it the identifier CVE-2026-50656 with a CVSS score of 7.8. The advisory states Microsoft is working on a high quality security update and will provide release information once available. The company has not detected exploitation of the vulnerability in the wild but rates it as exploitation more likely under its exploitability index.
RoguePlanet was originally released by the researcher known as Nightmare Eclipse, also tracked as Chaotic Eclipse, on June 10, hours after Microsoft's June Patch Tuesday updates shipped. The exploit takes advantage of a time of check to time of use race condition in Defender's real time scanning engine, replacing a file between the moment Defender verifies its path and the moment it acts on that file, allowing the substituted payload to execute with SYSTEM level privileges since Defender runs under that account.
RoguePlanet is the eighth public zero-day the researcher has released since around April 2026, following BlueHammer, RedSun, UnDefend, GreenPlasma, MiniPlasma, and YellowKey, three of which Microsoft fixed during June Patch Tuesday in the same week RoguePlanet appeared. The dispute between Nightmare Eclipse and Microsoft over disclosure practices remains unresolved, and Microsoft's advisory continued the pattern of not crediting the researcher.
- Verify application allowlisting is enforced on Windows 10 and 11 endpoints. This remains the confirmed effective control against RoguePlanet pending a Microsoft patch.
- Enable cloud delivered protection and attack surface reduction rules in block mode where not already configured.
- Monitor Windows event logs for unexpected SYSTEM level process creation from the Defender malware protection engine, the behavioural indicator for a successful exploitation attempt.
- Continue monitoring Microsoft's Security Update Guide for CVE-2026-50656 and apply the patch immediately once it ships, including out of band if Microsoft chooses to release one before the next scheduled Patch Tuesday.
CISA added CVE-2026-48907 to its Known Exploited Vulnerabilities catalog on June 16, 2026, citing evidence of active exploitation. The vulnerability resides in the JCE editor extension for Joomla and allows an attacker to create new editor profiles for unauthenticated users. Once such a profile exists, it can be used to upload and execute arbitrary PHP code on the underlying server, effectively giving the attacker full code execution.
The vulnerability carries a maximum CVSS score of 10.0, reflecting both the low complexity of exploitation and the severity of the resulting access. CISA's KEV addition requires federal civilian executive branch agencies to apply available fixes within the standard remediation window under Binding Operational Directive 22-01.
- Update the JCE editor extension to the patched version on all Joomla sites where it is installed.
- Review the site's editor profiles for any unauthorised or unexpected entries that may indicate prior exploitation.
- For sites where the extension cannot be patched immediately, consider disabling JCE entirely until the update can be applied.