MAL-2026-3905 Malicious code in @antv/f6-plugin (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-3906 Malicious code in @antv/f6-ui (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in @antv/f6-alipay (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-3902 Malicious code in @antv/f6-core (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in @antv/f6-ui (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in @antv/f6 (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in @antv/f6-wx (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-3900 Malicious code in @antv/f6 (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-3907 Malicious code in @antv/f6-wx (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

fhrons-mobile (>=1.1.2-5.2 <=1.2.4-beta.5), fhrons-mobile-next (>=2.0.1 <=2.0.4) +1 more potentially affected by unknown CVE via @antv/f6 (=0.0.19)

@antv/f6 NPM version =0.0.19 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/f6 and may be impacted: - fhrons-mobile =1.1.2-5.2, =2.0.1, =1.0.0, =1.0.2 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVF6-16754813...

@antv/f6-plugin (>=1.0.0 <=1.0.6) potentially affected by unknown CVE via @antv/f6-ui (>=1.0.0 <=1.0.3)

@antv/f6-ui NPM version =1.0.0, =1.0.0, =1.0.6 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVF6UI-16754906...

@antv/f6 (>=0.0.16 <=0.0.19), @antv/f6-plugin (>=1.0.3 <=1.0.6) +5 more potentially affected by unknown CVE via @antv/f6-hammerjs (=0.0.1)

@antv/f6-hammerjs NPM version =0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/f6-hammerjs and may be impacted: - @antv/f6 =0.0.16, =1.0.3, =0.0.11, =1.1.2-5.2, =2.0.1, =1.0.0, =1.0.2 Source cves: unknown CVE Source advisory:...

@antv/f6-plugin (>=1.0.0 <=1.0.6) potentially affected by unknown CVE via @antv/f6-ui (>=1.0.0 <=1.0.3)

@antv/f6-ui NPM version =1.0.0, =1.0.0, =1.0.6 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVF6UI-16755075...

@antv/f6 (>=0.0.3 <=0.0.19), fhrons-mobile (>=1.1.2-5.2 <=1.2.4-beta.5) +2 more potentially affected by unknown CVE via @antv/f6-element (=0.0.1)

@antv/f6-element NPM version =0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/f6-element and may be impacted: - @antv/f6 =0.0.3, =1.1.2-5.2, =2.0.1, =1.0.0, =1.0.2 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVF6ELEMENT-16755017...

@antv/f6 (>=0.0.2 <=0.0.19), @antv/f6-element (=0.0.1) +4 more potentially affected by unknown CVE via @antv/f6-core (=0.0.2)

@antv/f6-core NPM version =0.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/f6-core and may be impacted: - @antv/f6 =0.0.2, =1.0.0, =1.1.2-5.2, =2.0.1, =1.0.0, =1.0.2 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVF6CORE-16754479...

fhrons-mobile (=1.1.22-beta.8) potentially affected by unknown CVE via @antv/f6-wx (=0.0.7)

@antv/f6-wx NPM version =0.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/f6-wx and may be impacted: - fhrons-mobile =1.1.22-beta.8 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVF6WX-16755007...

@antv/f6 (>=0.0.16 <=0.0.19), @antv/f6-plugin (>=1.0.3 <=1.0.6) +5 more potentially affected by unknown CVE via @antv/f6-hammerjs (=0.0.1)

@antv/f6-hammerjs NPM version =0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/f6-hammerjs and may be impacted: - @antv/f6 =0.0.16, =1.0.3, =0.0.11, =1.1.2-5.2, =2.0.1, =1.0.0, =1.0.2 Source cves: unknown CVE Source advisory:...

@antv/f6 (>=0.0.3 <=0.0.19), fhrons-mobile (>=1.1.2-5.2 <=1.2.4-beta.5) +2 more potentially affected by unknown CVE via @antv/f6-element (=0.0.1)

@antv/f6-element NPM version =0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/f6-element and may be impacted: - @antv/f6 =0.0.3, =1.1.2-5.2, =2.0.1, =1.0.0, =1.0.2 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVF6ELEMENT-16754848...

fhrons-mobile (=1.1.22-beta.8) potentially affected by unknown CVE via @antv/f6-wx (=0.0.7)

@antv/f6-wx NPM version =0.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/f6-wx and may be impacted: - fhrons-mobile =1.1.22-beta.8 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVF6WX-16754838...

fhrons-mobile (>=1.1.2-5.2 <=1.2.4-beta.5), fhrons-mobile-next (>=2.0.1 <=2.0.4) +1 more potentially affected by unknown CVE via @antv/f6 (=0.0.19)

@antv/f6 NPM version =0.0.19 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/f6 and may be impacted: - fhrons-mobile =1.1.2-5.2, =2.0.1, =1.0.0, =1.0.2 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVF6-16754981...