140+ Mastra npm packages compromised with easy-day-js typosquat backdoor

Multiple packages in the Mastra npm organization were backdoored to drop remote payloads via a typosquat dependency on easy-day-js, affecting 140 or more packages. The incident highlights fragility in the AI agent framework ecosystem's supply chain, where build and deployment tools lack isolation mechanisms.