144 Mastra npm Packages Hijacked — CVE-2026-48907

144 Mastra AI npm packages compromised via hijacked contributor account. CVE-2026-48907 Joomla JCE CVSS 10.0 actively exploited.