Malicious code in @antv/graphlib (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

@aaf-comp/graph-widget (>=1.0.0 <=1.0.3), @agentscope-ai/chat (>=1.1.43 <=1.1.68-beta.1780902884191) +161 more potentially affected by unknown CVE via @antv/graphlib (=2.0.4)

@antv/graphlib NPM version =2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/graphlib and may be impacted: - @aaf-comp/graph-widget =1.0.0, =1.1.43, =5.0.48, =0.14.3, =2.2.2, =2.0.0, =1.0.0, =5.0.0, =0.1.1, =0.1.0-beta.1, =0.0.1, =0.0.1,...