Today we're launching Mastra Factory. When we started building a factory, we weren't sure what to expect. But over the last few weeks it's has been writing 30% of our PRs, closing 60% of issues. Factory is free + open-source, now you can try it too:

We completely revamped 𝚌𝚛𝚎𝚊𝚝𝚎 𝚖𝚊𝚜𝚝𝚛𝚊 and replaced the humble weather agent with a powerful harness template! It can: - Code in a sandbox - Create a task list - Search and fetch the web - Remember anything - Run for days Quick video showing you how it works:

One of the coolest things about Mastra sandboxes is the ability to FUSE-mount filesystems like S3 Mounts can be read-only for seeding files Or you can give an ephemeral sandbox persistent storage. Even if the sandbox is destroyed and recreated, it can reconnect to the same filesystem and access the same files!

🚨 SlowMist TI Alert 🚨 A coordinated npm supply chain attack affecting 140+ @mastra/* packages. The affected packages added a dependency on easy-day-js@^1.11.21, which can be automatically resolved during installation to the malicious version easy-day-js@1.11.22, triggering attacker-controlled code through an install-time hook. Potential attacker actions include install-time code execution, persistence on Windows/macOS/Linux, browser history collection, cryptocurrency wallet extension inventory, credential or CI secret exposure through follow-on tasking, and data exfiltration. Treat any system that installed affected @mastra/* versions as potentially compromised: remove malicious versions and easy-day-js, delete node_modules and package caches, reinstall known-clean versions with verified lockfiles, isolate impacted hosts, preserve logs, remove persistence artifacts, and rotate npm, GitHub, cloud, SSH/Git, CI/CD, and wallet-related credentials where exposure is possible. As always, stay vigilant!