GHSA Malware advisory is missing some packages of Mastra supply chain attack campaign

[socketz]

Hi,

Please, review better the current malware campaign for Mastra packages are missing in the GHSA advisory.

Take a look to this URL from the provider:
https://github.com/mastra-ai/mastra/blob/main/.changeset/easy-day-js-security-remediation.md?plain=1

Missing packages example (and probably more):

Package	Version
@mastra/acp	0.2.2
@mastra/agentcore	0.2.2
@mastra/agentfs	0.1.1
@mastra/arthur	0.3.3
@mastra/astra	1.0.2

More references:

• https://thehackernews.com/2026/06/144-mastra-npm-packages-compromised-via.html
• https://www.stepsecurity.io/blog/mastra-npm-packages-compromised-using-easy-day-js
• https://socket.dev/blog/mastra-npm-packages-compromised
• https://socket.dev/supply-chain-attacks/mastra-ai-framework-compromise
• https://safedep.io/mastra-npm-scope-takeover-supply-chain-attack/