# mastra

Published articles for mastra.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Agent Night demo recap: How Mastra turned its issue backlog into a software factory

DevFeed: [Agent Night demo recap: How Mastra turned its issue backlog into a software factory](<https://devfeed.tech/articles/agent-night-demo-recap-how-mastra-turned-its-issue-backlog-into-a-software-factory-15988.md>)

Original publisher: [Read original article](<https://workos.com/blog/agent-night-mastra-software-factory-demo-recap>)

Author: WorkOS

Published: 2026-08-17T19:04:08Z

Content type: news

Language: en

Sources: [WorkOS Blog](<https://devfeed.tech/sources/workos-blog.md>)

Topics: [Development](<https://devfeed.tech/topics/development.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [coding](<https://devfeed.tech/topics/coding.md>), [Software](<https://devfeed.tech/topics/software.md>), [Command-line interface](<https://devfeed.tech/topics/cli.md>)

Tags: [agent](<https://devfeed.tech/tags/agent.md>), [agentic](<https://devfeed.tech/tags/agentic.md>), [agentic-development](<https://devfeed.tech/tags/agentic-development.md>), [agents](<https://devfeed.tech/tags/agents.md>), [coding](<https://devfeed.tech/tags/coding.md>), [demo](<https://devfeed.tech/tags/demo.md>), [development](<https://devfeed.tech/tags/development.md>), [harness](<https://devfeed.tech/tags/harness.md>), [mastra](<https://devfeed.tech/tags/mastra.md>), [memory](<https://devfeed.tech/tags/memory.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [open-source-software](<https://devfeed.tech/tags/open-source-software.md>), [recap](<https://devfeed.tech/tags/recap.md>), [software](<https://devfeed.tech/tags/software.md>), [terminal](<https://devfeed.tech/tags/terminal.md>)

### AI overview

The article recaps Abhi Aiyer's Agent Night demonstration of Mastra's open source software factory. It describes observational memory, Mastra Code, and the AgentController, which supports building interactive agent applications with modes, models, storage, workspaces, approvals, subagents, and channels.

### Source excerpt

Abhi Aiyer, co-founder and CTO of Mastra, demoed the company's open source software factory at Agent Night: memory, harness, a rules engine around work.

## The Mastra AI Ecosystem Was Poisoned At The Registry Level

DevFeed: [The Mastra AI Ecosystem Was Poisoned At The Registry Level](<https://devfeed.tech/articles/the-mastra-ai-ecosystem-was-poisoned-at-the-registry-level-13458.md>)

Original publisher: [Read original article](<https://www.harness.io/blog/poisoning-the-pipeline-how-the-mastra-ai-ecosystem-was-poisoned-at-the-registry-level>)

Author: Roshan Piyush

Published: 2026-07-14T00:00:00Z

Content type: article

Language: en

Sources: [Harness Blog](<https://devfeed.tech/sources/harness-blog.md>)

Topics: [software supply-chain attack](<https://devfeed.tech/topics/software-supply-chain-attack.md>), [npm packages](<https://devfeed.tech/topics/npm-packages.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>), [TypeScript](<https://devfeed.tech/topics/typescript.md>), [Cloud](<https://devfeed.tech/topics/cloud.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [malicious-packages](<https://devfeed.tech/tags/malicious-packages.md>), [malware](<https://devfeed.tech/tags/malware.md>), [mastra](<https://devfeed.tech/tags/mastra.md>), [npm](<https://devfeed.tech/tags/npm.md>), [npm-packages](<https://devfeed.tech/tags/npm-packages.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>), [software-supply-chain-attack](<https://devfeed.tech/tags/software-supply-chain-attack.md>), [typescript](<https://devfeed.tech/tags/typescript.md>)

### AI overview

The article examines a June 17, 2026 software supply-chain attack targeting the Mastra AI TypeScript ecosystem. It reports that a compromised contributor account was used to publish 144 malicious packages under the official @mastra npm scope, with registry-level changes introducing the easy-day-js transitive dependency. Installations during the compromise window could expose developer workstations, CI/CD runners, and cloud environments to an information stealer.

### Source excerpt

Learn how the Mastra AI supply chain attack poisoned npm packages, impacted AI pipelines, and how Harness SCS helps detect, block, and remediate compromised dep | Blog

## @mastra npm scope takeover: 143 packages backdoored via compromised contributor account

DevFeed: [@mastra npm scope takeover: 143 packages backdoored via compromised contributor account](<https://devfeed.tech/articles/mastra-npm-scope-takeover-143-packages-backdoored-via-compromised-contributor-account-13149.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/mastra-npm-scope-takeover-143-packages-backdoored-via-compromised-contributor-account>)

Published: 2026-06-17T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [npm](<https://devfeed.tech/topics/npm.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [Remote Access Trojan](<https://devfeed.tech/topics/remote-access-trojan.md>), [Cryptocurrency](<https://devfeed.tech/topics/cryptocurrency.md>), [C2](<https://devfeed.tech/topics/c2.md>)

Tags: [c2](<https://devfeed.tech/tags/c2.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-packages](<https://devfeed.tech/tags/chainguard-packages.md>), [command-and-control](<https://devfeed.tech/tags/command-and-control.md>), [crypto](<https://devfeed.tech/tags/crypto.md>), [malware](<https://devfeed.tech/tags/malware.md>), [mastra](<https://devfeed.tech/tags/mastra.md>), [npm](<https://devfeed.tech/tags/npm.md>), [npm-takeover](<https://devfeed.tech/tags/npm-takeover.md>), [packages](<https://devfeed.tech/tags/packages.md>), [provenance](<https://devfeed.tech/tags/provenance.md>), [remote-access](<https://devfeed.tech/tags/remote-access.md>), [remote-access-trojan](<https://devfeed.tech/tags/remote-access-trojan.md>), [secure-packages](<https://devfeed.tech/tags/secure-packages.md>), [software-packages](<https://devfeed.tech/tags/software-packages.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [tls](<https://devfeed.tech/tags/tls.md>)

### AI overview

The article reports that an attacker used a compromised former contributor account to republish all 143 packages in the @mastra npm scope on June 17, 2026. The malicious versions could disable TLS verification, download a cryptocurrency wallet stealer and remote access trojan, and establish command-and-control access. It recommends auditing dependency trees and lockfiles and rotating credentials on affected hosts.

### Source excerpt

A supply chain attack compromised all 143 @mastra packages. Chainguard customers stayed protected through malware blocking and source-built libraries.