MAL-2026-4015 Malicious code in @antv/gi-sdk (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-4016 Malicious code in @antv/gi-sdk-app (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

@antv/gi-assets-advance (>=1.0.0 <=2.2.1), @antv/gi-assets-algorithm (>=1.0.0 <=2.0.0) +11 more potentially affected by unknown CVE via @antv/gi-sdk (>=3.0.0-alpha.0 <=3.0.0)

@antv/gi-sdk NPM version =3.0.0-alpha.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0-beta.0, =1.0.1, =1.0.0, =1.0.0, =0.2.0, =0.6.25 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVGISDK-16754397...