@mastra/core is the core npm package of the Mastra AI framework, receiving over 918K weekly downloads. It was among the 145 packages compromised in the June 2026 supply chain attack, giving the campaign a large potential blast radius. The malicious versions were published via a hijacked contributor account.