6 matches found
MAL-2026-3885 Malicious code in @antv/f-react (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
@antv/f-engine (=0.0.2), @antv/f-my (=0.0.2) +3 more potentially affected by unknown CVE via @antv/g-css-layout-api (=1.0.38)
@antv/g-css-layout-api NPM version =1.0.38 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/g-css-layout-api and may be impacted: - @antv/f-engine =0.0.2 - @antv/f-my =0.0.2 - @antv/f-react =0.0.2 - @antv/f2-wx =0.0.2 - @antv/g =5.8.9, =5.16.33...
@antv/f-engine (=0.0.2), @antv/f-my (=0.0.2) +3 more potentially affected by unknown CVE via @antv/g-css-typed-om-api (=1.0.38)
@antv/g-css-typed-om-api NPM version =1.0.38 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/g-css-typed-om-api and may be impacted: - @antv/f-engine =0.0.2 - @antv/f-my =0.0.2 - @antv/f-react =0.0.2 - @antv/f2-wx =0.0.2 - @antv/g =5.8.9, =5.16.3...
@antv/f-engine (=0.0.2), @antv/f-my (=0.0.2) +3 more potentially affected by unknown CVE via @antv/g-css-layout-api (=1.0.38)
@antv/g-css-layout-api NPM version =1.0.38 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/g-css-layout-api and may be impacted: - @antv/f-engine =0.0.2 - @antv/f-my =0.0.2 - @antv/f-react =0.0.2 - @antv/f2-wx =0.0.2 - @antv/g =5.8.9, =5.16.33...
@antv/f2-react (>=5.0.19 <=5.14.0), @antv/f2-site (=5.0.0-alpha.1) potentially affected by unknown CVE via @antv/f-react (=1.10.0)
@antv/f-react NPM version =1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/f-react and may be impacted: - @antv/f2-react =5.0.19, =5.14.0 - @antv/f2-site =5.0.0-alpha.1 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVFREACT-16755126...
@antv/f2-react (>=5.0.19 <=5.14.0), @antv/f2-site (=5.0.0-alpha.1) potentially affected by unknown CVE via @antv/f-react (=1.10.0)
@antv/f-react NPM version =1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/f-react and may be impacted: - @antv/f2-react =5.0.19, =5.14.0 - @antv/f2-site =5.0.0-alpha.1 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVFREACT-16754957...