@action.sustainability/storybook-dashboard (>=0.1.1 <=0.1.5), @ada-lc/fusion-materials (>=0.1.1 <=0.1.3) +552 more potentially affected by unknown CVE via @antv/g2plot (>=2.2.13 <=2.4.8)

@antv/g2plot NPM version =2.2.13, =0.1.1, =0.1.1, =0.1.0, =0.0.2, =0.1.2, =1.1.15, =1.0.4, =0.1.5, =1.0.0, =0.0.1, =1.0.2, =1.0.0-alpha.1, =1.0.3, =1.1.4, =1.1.6-alpha.1 and more Source cves: unknown CVE Source advisory: OSV:MAL-2026-3980...

Malicious code in @antv/g2plot (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...