@2nova/wu-ui (>=1.1.0 <=1.3.12), @action.sustainability/storybook-dashboard (>=0.1.1 <=0.1.5) +1998 more potentially affected by unknown CVE via @antv/adjust (>=0.0.7 <=0.2.5)

@antv/adjust NPM version =0.0.7, =1.1.0, =0.1.1, =0.1.1, =0.1.0, =0.0.2, =0.0.1-beta, =0.1.2, =0.1.0, =0.5.0-alpha.0, =0.1.0, =0.5.0-alpha.0, =0.5.0-alpha.0, =0.1.0, =0.1.0, =1.0.0 and more Source cves: unknown CVE Source advisory: OSV:MAL-2026-3849...

Malicious code in @antv/adjust (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...