Is It Dead Yet? dependency vitals

@mastra/corenpm

Signals · last 1 check

Commits 90d
100
Open issues
269
Unanswered
1
Contributors
27
State history 1
WhenChange
2026-09-03 first verdict: active
Supply-chain history 1

  1. account hijacked 2026-06 1.42.1

    An employee’s machine was compromised through a social-engineering link and 141 packages were republished with a dependency whose post-install script pulled a wallet-stealing trojan.

    Removed; the project published an incident report.

    Source: Aikido analysis and the Mastra incident report, 17 June 2026. History, not a warning about today — the verdict above is about maintenance now.

Badge

maintenance: active

Drop this in your README. It re-renders itself as the verdict changes.

[![maintenance](https://isitdeadyet.dev/badge/npm/@mastra/core.svg)](https://isitdeadyet.dev/npm/@mastra/core)

Watch it

Get told when @mastra/core changes state, changes licence, or is deprecated — instead of finding out during an incident.

Free for up to 25 packages. Signing in is a link sent to your email — there is no password to choose.