Malicious code in @antv/t8 (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

@antv/gpt-vis (>=1.0.0 <=1.0.0-beta.2) potentially affected by unknown CVE via @antv/t8 (=0.3.0)

@antv/t8 NPM version =0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/t8 and may be impacted: - @antv/gpt-vis =1.0.0, =1.0.0-beta.2 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVT8-16754369...