Malicious code in @antv/f2-vue (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

@haloe/mobile-pro (>=0.0.1 <=4.1.0) potentially affected by unknown CVE via @antv/f2-vue (=4.0.33)

@antv/f2-vue NPM version =4.0.33 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/f2-vue and may be impacted: - @haloe/mobile-pro =0.0.1, =4.1.0 Source cves: unknown CVE Source advisory: OSV:MAL-2026-3897...

Malicious code in @antv/f2-wordcloud (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

@antv/f2 (>=4.0.0 <=5.0.0-alpha.1), @antv/f2-my (>=4.0.0 <=4.0.52) +7 more potentially affected by unknown CVE via @antv/f2-graphic (>=0.0.1 <=0.0.9)

@antv/f2-graphic NPM version =0.0.1, =4.0.0, =4.0.0, =0.0.1, =4.0.0-4.0.0-alpha.3.0, =4.0.0, =4.0.0, =0.0.1, =0.1.1, =1.0.0, =1.3.0-alpha.0 Source cves: unknown CVE Source advisory: OSV:MAL-2026-3893...

@antv/f-my (>=0.0.1 <=1.6.0), @antv/f2-my (>=4.0.0 <=5.0.0-alpha.1) +13 more potentially affected by unknown CVE via @antv/f2-context (>=0.0.0 <=0.0.1)

@antv/f2-context NPM version =0.0.0, =0.0.1, =4.0.0, =2.0.0, =0.1.0, =0.3.1, =0.3.1, =1.0.0, =1.1.0, =1.0.0, =1.0.1 - qn-pc-f2 =0.1.2 Source cves: unknown CVE Source advisory: OSV:MAL-2026-3892...

Malicious code in @antv/f2-react (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-3892 Malicious code in @antv/f2-context (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in @antv/f2 (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

@antv/f-charts (=0.0.0), @antv/f2 (>=5.0.27 <=5.14.0) +7 more potentially affected by unknown CVE via @antv/f-lottie (=1.10.0)

@antv/f-lottie NPM version =1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/f-lottie and may be impacted: - @antv/f-charts =0.0.0 - @antv/f2 =5.0.27, =5.0.0-alpha.1, =5.0.0-alpha.1, =5.0.1, =0.1.6, =0.9.5 Source cves: unknown CVE Source...

@antv/f2-react (>=5.0.19 <=5.14.0), @antv/f2-site (=5.0.0-alpha.1) potentially affected by unknown CVE via @antv/f-react (=1.10.0)

@antv/f-react NPM version =1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/f-react and may be impacted: - @antv/f2-react =5.0.19, =5.14.0 - @antv/f2-site =5.0.0-alpha.1 Source cves: unknown CVE Source advisory: OSV:MAL-2026-3885...

@antv/f-charts (=0.0.0), @antv/f2-my (=5.0.0-alpha.1) +6 more potentially affected by unknown CVE via @antv/f2 (>=5.0.28 <=5.14.0)

@antv/f2 NPM version =5.0.28, =5.0.0-alpha.1, =5.0.0-alpha.1, =5.0.1, =0.1.6, =0.9.5 Source cves: unknown CVE Source advisory: OSV:MAL-2026-3889...

@antv/f2-site (=5.0.0-alpha.1) potentially affected by unknown CVE via @antv/f2-react (=5.14.0)

@antv/f2-react NPM version =5.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/f2-react and may be impacted: - @antv/f2-site =5.0.0-alpha.1 Source cves: unknown CVE Source advisory: OSV:MAL-2026-3895...

MAL-2026-3889 Malicious code in @antv/f2 (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-3893 Malicious code in @antv/f2-graphic (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...