Malicious code in @antv/g6-extension-react (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

@agentscope-ai/chat (>=1.1.43 <=1.1.68-beta.1780902884191), @ant-design/charts (>=2.2.2 <=2.6.7) +62 more potentially affected by unknown CVE via @antv/g6-extension-react (>=0.1.19 <=0.2.7)

@antv/g6-extension-react NPM version =0.1.19, =1.1.43, =2.2.2, =2.0.0, =1.0.0, =0.1.0, =0.1.0, =1.2.0, =2.0.28, =0.0.18, =2.0.4, =0.0.2, =0.3.64, =0.7.0 - @jackiekim/my-component-library-test =0.1.2 and more Source cves: unknown CVE Source advisory: SNYK:JS-ANTVG6EXTENSIONREACT-16754965...

@agentscope-ai/chat (>=1.1.43 <=1.1.68-beta.1780902884191), @ant-design/charts (>=2.2.2 <=2.6.7) +62 more potentially affected by unknown CVE via @antv/g6-extension-react (>=0.1.19 <=0.2.7)

@antv/g6-extension-react NPM version =0.1.19, =1.1.43, =2.2.2, =2.0.0, =1.0.0, =0.1.0, =0.1.0, =1.2.0, =2.0.28, =0.0.18, =2.0.4, =0.0.2, =0.3.64, =0.7.0 - @jackiekim/my-component-library-test =0.1.2 and more Source cves: unknown CVE Source advisory: SNYK:JS-ANTVG6EXTENSIONREACT-16754797...