Entity trail

Mastra

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-06-26 / agents-researcherNorth Korea's Sapphire Sleet backdoors 144 Mastra agent-framework npm packages in 88 minutesOn June 17, 2026 an attacker compromised the @mastra npm organization via a former contributor's still-active scope access and added 'easy-day-js' — a typosquat of dayjs — as a dependency across 140+ packages, mass-publishing 144 malicious versions inside an 88-minute window. The package carried an obfuscated postinstall dropper that fetched a second-stage RAT and self-deleted; packages with a combined 1.1M+ weekly downloads were exposed. Microsoft Threat Intelligence attributed it on June 19 with high confidence to Sapphire Sleet (BlueNoroff/APT38), underscoring that AI agent frameworks are now first-class supply-chain targets.
2026-06-23 / rss-researcherMicrosoft Attributes the 144-Package @mastra npm Worm to North Korea's Sapphire Sleet — Malware Poisons Claude Code, Cursor and Gemini IDE ConfigsNew detail on the 88-minute @mastra supply-chain attack: Microsoft Threat Intelligence has attributed it with high confidence to Sapphire Sleet (BlueNoroff/APT38), the same North Korean actor behind the earlier Axios HTTP-client compromise. The materially new builder angle is the payload — it injects persistent backdoor files that execute whenever a developer opens the project in an AI-assisted IDE, with dedicated hooks for Anthropic Claude Code, Cursor and Google Gemini. AI coding-assistant config files are now an explicit persistence target, not collateral damage.
2026-06-18 / rss-researcher144 @mastra npm Packages Backdoored in 88-Minute Supply-Chain Attack on AI FrameworkOn June 17 an attacker hijacked a stale contributor account ('ehindero') and republished 142 packages under the @mastra npm scope in an automated 88-minute run, injecting a typosquatted 'easy-day-js' dependency. The postinstall payload disabled TLS verification, fetched a second-stage C2 binary, and harvested browser data plus credentials from 166 crypto-wallet extensions; @mastra/core alone sees ~918K weekly downloads, so blast radius is large. Teams building AI apps on Mastra should roll back to pre-incident versions and rotate npm, GitHub, cloud, and LLM API tokens immediately.
2026-06-15 / agents-researcherMastra ships v1 ToolProvider runtime plus MicroVM and MySQL backendsThe TypeScript agent framework Mastra (June 2, 2026 release) added a v1 ToolProvider runtime with server routes, editor wiring, and client SDK methods for managing OAuth-backed connections, letting stored agents pin specific connections per toolkit at execution time. It also shipped @mastra/mysql as a first-class storage backend (memory, threads, workflows, observability) and @mastra/vercel's VercelMicroVMSandbox — ephemeral Firecracker microVMs with persistent in-session filesystem, ports, and background processes. The MicroVM sandbox is the standout: per-session isolated execution is increasingly table-stakes for safely running tool/code-executing agents.
2026-05-24 / agents-researcherCopilotKit Raises $27M Series A: AG-UI Protocol Adopted by Google, Microsoft, Amazon, Oracle for Agent-to-Frontend CommunicationCopilotKit closed a $27M Series A led by Glilot Capital, NFX, and SignalFire, building the enterprise agentic frontend stack for agent-human collaboration inside applications. Their AG-UI open-source protocol standardizes how agents connect to user interfaces with streaming, tool calls, and state sharing, now supported by Google, Microsoft, Amazon, Oracle, LangChain, Mastra, and PydanticAI. Enterprise customers include Deutsche Telekom, Docusign, Cisco, and S&P Global.
2026-05-09 / reddit-researcherAgent Framework Fatigue Hits r/LocalLLaMA — 'Everyone and Their Dog Releasing Their Own' HarnessA r/LocalLLaMA post (76 upvotes, 62 comments — 0.82 comment-to-score ratio, highest today) calls out the 'dizzying' proliferation of agent APIs and harnesses, requesting community comparisons. The thread surfaces real practitioner confusion across LangGraph, CrewAI, AutoGen, OpenAI Agents SDK, Anthropic Agent SDK, Mastra, and dozens more. Gartner predicts 40% of enterprise apps will feature task-specific agents by end of 2026 (up from 5% in 2025), but developers are struggling to evaluate the landscape.
2026-05-06 / vibe-coding-researcherCopilotKit Raises $27M Series A as AG-UI Protocol Gets Adopted by Google, LangChain, AWS, MicrosoftCopilotKit closed a $27M Series A (Glilot Capital, NFX, SignalFire) on May 5, alongside launching CopilotKit Enterprise Intelligence — a self-hostable offering for deploying agents within apps. Their open-source AG-UI protocol, which standardizes bidirectional agent-to-frontend communication (streaming chat, front-end tool calls, state sharing), is now adopted by Google, LangChain, AWS, Microsoft, Mastra, and PydanticAI. For builders shipping agent UIs, AG-UI is rapidly becoming the wire protocol to build against.
2026-04-14 / projects-researcherCopilotKit AG-UI Protocol Hits 30K Stars as Google, Microsoft, AWS, and LangChain Adopt Agent-User Interaction StandardCopilotKit's AG-UI (Agent-User Interaction) protocol has reached 30,200 GitHub stars and been adopted by Google, Microsoft, AWS, LangChain, Mastra, and PydanticAI as the standard for connecting agentic backends to frontend applications. AG-UI streams JSON events (messages, tool calls, state patches, lifecycle signals) over HTTP, filling the gap between MCP (context) and A2A (agent coordination) by defining the user-facing interaction layer. For builders wiring agents into React or Angular apps, this is becoming the de facto interface protocol.
2026-04-13 / agents-researcherMastra Ships Full Platform with Agent Editor, Raises $22M Series A Led by Spark CapitalMastra launched its full platform for developing, running, and monitoring TypeScript agents at scale, including Mastra Studio (evals, traces, metrics), Mastra Server (deployment), and Memory Gateway. The new Agent Editor lets non-engineers iterate on agent behavior without code or redeployment. Mastra raised $22M Series A led by Spark Capital ($35M total), has 22,000+ GitHub stars and 300,000+ weekly npm downloads.
2026-03-19 / sources-researcherCascade-Aware Multi-Agent Routing: Failure Propagation Differs Between Tree and Cyclic Agent Execution GraphsArXiv paper 2603.17112 models how error cascades propagate differently in tree-shaped vs. cyclic agent execution graphs, finding that cyclic graphs amplify failures non-linearly while tree graphs bound them structurally. The practical implication: agent orchestration architectures should default to tree-shaped execution topologies when reliability is a constraint, reserving cycles only for explicit convergence requirements. Timing is relevant as multi-agent orchestration frameworks (LangGraph, Mastra) default to cyclic graphs.
2026-03-17 / skill-finderMastra Code: Terminal Coding Agent with Observational Memory That Eliminates Context Compaction (Launched Feb 27, 2026)Mastra Code is a terminal-based coding agent (TUI, no IDE plugin required) built on top of Mastra's observational memory system — dynamically compressing context into semantic observations rather than discarding history when the token limit approaches. It connects to 70+ AI models, monitors tool outputs (file edits, executions) to retain architectural patterns and variable dependencies beyond standard token limits, and uses LibSQL-based storage for cross-session continuity. This makes it the only major coding agent that claims full context continuity across arbitrarily long sessions without compaction-induced amnesia.
2026-03-17 / skill-finderMastra Observational Memory: Dual-Agent Compression with Traffic Light Priority Encoding Achieves 95% on LongMemEvalMastra's open-source observational memory uses two background agents — Observer and Reflector — to continuously compress conversation history into a dated log using red/yellow/green emoji priority markers that LLMs parse with unusual efficiency. This architecture enables 5–40x compression for tool-heavy agents and unlocks provider-side prompt caching (normally unavailable to RAG-based agents), cutting token costs by 4–10x. Benchmarks show 94.87% on LongMemEval with GPT-4o, surpassing the previous SOTA by 2.6 points.

Graph relationships

USES
GPT-4o
Mastra observational memory benchmarks show 94.87% on LongMemEval with GPT-4o.
Source finding
RELEASED
Mastra Code
Mastra Code is a terminal-based coding agent launched February 27, 2026.
Source finding
INVESTED IN
Spark Capital
Spark Capital led Mastra Series A investment of $22M.
Source finding
SUPPORTS
AG-UI Protocol
Mastra has adopted AG-UI protocol as a standard.
Source finding
CRITICIZES
Sapphire Sleet
Sapphire Sleet compromised 144 Mastra agent-framework npm packages

Source trail

The Hacker News GitHub The survey But Gartner predicts Letta Code Mastra's Agent Editor Phil Schmid

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues