Malicious code in @antv/f-lottie (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-3883 Malicious code in @antv/f-lottie (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

@antv/f-charts (=0.0.0), @antv/f2 (>=5.0.27 <=5.14.0) +7 more potentially affected by unknown CVE via @antv/f-lottie (=1.10.0)

@antv/f-lottie NPM version =1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/f-lottie and may be impacted: - @antv/f-charts =0.0.0 - @antv/f2 =5.0.27, =5.0.0-alpha.1, =5.0.0-alpha.1, =5.0.1, =0.1.6, =0.9.5 Source cves: unknown CVE Source...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

@antv/f-charts (=0.0.0), @antv/f2 (>=5.0.27 <=5.14.0) +7 more potentially affected by unknown CVE via @antv/f-lottie (=1.10.0)

@antv/f-lottie NPM version =1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/f-lottie and may be impacted: - @antv/f-charts =0.0.0 - @antv/f2 =5.0.27, =5.0.0-alpha.1, =5.0.0-alpha.1, =5.0.1, =0.1.6, =0.9.5 Source cves: unknown CVE Source...