Immediate Containment
! Quarantine builds and workstations that installed affected Mastra packages.
! Block the documented C2 IP addresses and domains.
Exposure Reduction & Patching
🛡️ Review node_modules and lockfiles for easy-day-js and affected Mastra versions.
📦 Remove compromised packages and reinstall from known-good versions after dependency review.
Configuration & Credentials
⚙️ Disable lifecycle scripts in controlled CI where operationally feasible and review package provenance.
🔑 Rotate credentials and tokens available to affected developer or CI environments based on forensic findings.
Evidence Preservation
📁 Preserve package manifests, lockfiles, CI logs, and host telemetry with timestamps.
Verification & Rollback
✓ Confirm no affected package versions remain and review outbound connections.
↩️ Rollback: Use the package manager rollback procedure if a verified dependency update causes regression.