MAL-2026-4083 Malicious code in @antv/scale (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

1byte-react-design (>=1.7.1 <=1.14.0), 1g6table (=0.1.0) +2674 more potentially affected by unknown CVE via @antv/scale (>=0.0.1 <=0.5.2)

@antv/scale NPM version =0.0.1, =1.7.1, =1.1.0, =0.1.1, =0.1.1, =0.1.0, =0.0.2, =0.0.1-beta, =0.1.2, =1.1.43, =5.0.48, =1.0.1, =1.1.44 and more Source cves: unknown CVE Source advisory: OSV:MAL-2026-4083...