Kodem Security Research Team

Mastra npm Packages Compromised: easy-day-js Supply Chain Attack

On June 17, 2026, a hijacked contributor account republished more than 140 @mastra npm packages with a malicious easy-day-js dropper that delivers a crypto-stealer and RAT. Get the IOCs, timeline, and first-hour runbook.

CVE-2026-9277 shell-quote Command Injection

CVE-2026-9277 is a shell-quote command injection flaw in npm versions 1.1.0 through 1.8.3. See how the quote() bypass works, what to hunt, and the 1.8.4 fix.

TanStack OpenAI Supply Chain Attack: Mini Shai-Hulud, IOCs, and First-Hour Response Runbook

The TanStack OpenAI supply chain attack delivered Mini Shai-Hulud through trusted npm publishing. Get the IOCs, affected packages, and first-hour runbook.