A hijacked former-contributor account republished more than 140 Mastra npm packages with a dependency on the malicious `easy-day-js` typosquat. Its install-time dropper fetched and launched a persistent cross-platform wallet stealer and RAT that collected browser and host data, targeted cryptocurrency extensions, and accepted follow-on commands from attacker infrastructure. Hosts that installed affected packages require persistence hunting, credential rotation, wallet migration, and potentially reimaging because removing the npm dependency does not terminate the detached payload.