{"type":"bundle","id":"bundle--fe3dd159-a986-50b0-8bce-93bc45f4d47c","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--d1c79297-8bee-5f73-93b2-f01e94803017","created":"2026-08-09T11:30:00.000Z","modified":"2026-08-09T11:20:00.000Z","name":"Mastra AI framework npm compromise","description":"Socket documented a June 2026 compromise of more than 140 packages in the @mastra npm scope where a typosquatted dependency with a postinstall payload was injected into published package manifests.","aliases":["Mastra AI framework compromise"],"first_seen":"2026-06-17T01:15:00.000Z","last_seen":"2026-06-17T02:36:00.000Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"Socket: Mastra npm package compromise","url":"https://socket.dev/blog/mastra-npm-packages-compromised"}]}]}