Hijacked ex-contributor token enables mass Mastra scope poisoning via easy-day-js dependency

The attack chain relied on a clean initial publish of easy-day-js by sergey2016 followed by postinstall hook that disabled TLS validation, fetched a dropper from 23.254.164[.]92, executed a detached stealer harvesting 160+ crypto-wallet extensions, and self-deleted. Evidence from SafeDep and StepSecurity shows every poisoned package lacked SLSA provenance that legitimate Mastra CI builds carry, exposing the absence of mandatory attestation enforcement on the namespace.

This incident repeats the exact maintainer-account pattern seen in prior scope-wide compromises where tokens were never rotated after contributor departure. Unlike isolated typosquatting, the choice of an AI-framework namespace with cloud-credential exposure indicates deliberate targeting of high-value build environments rather than opportunistic malware distribution.

Npm removed the tagged versions yet left the underlying token-issuance model unchanged. Without enforced provenance checks or automated scope-owner alerts on dormant accounts, the same vector remains open across other popular scopes that still permit unauthenticated publishes from legacy tokens.