Inside the Mastra npm Supply Chain Attack
Date Observed: June 17, 2026Ecosystem: npm (@mastra scope)Targets: Developer workstations and CI/CD runners installing @mastra/* packagesAttack Type: Account takeover + dependency injection + typosquatting + credential-stealing RATImpact: Over 140 packages trojanized; ~8M weekly downloads exposed; cryptocurrency wallet and credential theft Key Takeaways A Mastra contributor’s npm account was hijacked after scope permissions were never revoked, […]
Healthcare Software Supply Chain Security Explained
By David Pulaski, CXO & Co-Founder, InvisiRiskPublished June 2026 TL;DR Healthcare software is assembled from open-source packages, third-party code, and automated CI/CD pipelines, and most of the security tools protecting it look at code before the build or the running application after it. The build itself, where dependencies execute, secrets are live, and network connections […]