4 matches found
Malicious code in @antv/async-hook (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
MAL-2026-3851 Malicious code in @antv/async-hook (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
@action.sustainability/storybook-dashboard (>=0.1.1 <=0.1.5), @agentlab/ldkg-ui-charts (>=0.1.4 <=0.1.7) +297 more potentially affected by unknown CVE via @antv/async-hook (=2.2.9)
@antv/async-hook NPM version =2.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/async-hook and may be impacted: - @action.sustainability/storybook-dashboard =0.1.1, =0.1.4, =1.1.15, =0.1.0, =1.0.17-beta.1, =0.0.1-beta.2, =0.1.0, =1.2.0-beta.0...
@action.sustainability/storybook-dashboard (>=0.1.1 <=0.1.5), @agentlab/ldkg-ui-charts (>=0.1.4 <=0.1.7) +297 more potentially affected by unknown CVE via @antv/async-hook (=2.2.9)
@antv/async-hook NPM version =2.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/async-hook and may be impacted: - @action.sustainability/storybook-dashboard =0.1.1, =0.1.4, =1.1.15, =0.1.0, =1.0.17-beta.1, =0.0.1-beta.2, =0.1.0, =1.2.0-beta.0...