MAL-2026-3882 Malicious code in @antv/f-engine (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

@antv/f-charts (=0.0.0), @antv/f-lottie (>=0.0.1 <=1.10.0) +14 more potentially affected by unknown CVE via @antv/f-engine (>=1.0.10 <=1.10.0)

@antv/f-engine NPM version =1.0.10, =0.0.1, =0.0.1, =1.0.1, =0.0.1, =1.0.1, =5.0.27, =5.0.0-alpha.1, =5.0.0-alpha.1, =5.0.1, =0.0.1, =0.0.1-alpha.1, =1.0.3 and more Source cves: unknown CVE Source advisory: OSV:MAL-2026-3882...