MAL-2026-3905 Malicious code in @antv/f6-plugin (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

@antv/f6 (>=0.0.2 <=0.0.19), @antv/f6-element (=0.0.1) +4 more potentially affected by unknown CVE via @antv/f6-core (=0.0.2)

@antv/f6-core NPM version =0.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/f6-core and may be impacted: - @antv/f6 =0.0.2, =1.0.0, =1.1.2-5.2, =2.0.1, =1.0.0, =1.0.2 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVF6CORE-16754479...

@antv/f6-plugin (>=1.0.0 <=1.0.6) potentially affected by unknown CVE via @antv/f6-ui (>=1.0.0 <=1.0.3)

@antv/f6-ui NPM version =1.0.0, =1.0.0, =1.0.6 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVF6UI-16754906...

@antv/f6-plugin (>=1.0.0 <=1.0.6) potentially affected by unknown CVE via @antv/f6-ui (>=1.0.0 <=1.0.3)

@antv/f6-ui NPM version =1.0.0, =1.0.0, =1.0.6 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVF6UI-16755075...