Malicious code in @antv/torch (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-4090 Malicious code in @antv/torch (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

@antv/torch (>=1.0.0 <=1.0.6), @diogoxiang/utils (=1.0.0) potentially affected by unknown CVE via @antv/istanbul (=0.0.0)

@antv/istanbul NPM version =0.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/istanbul and may be impacted: - @antv/torch =1.0.0, =1.0.6 - @diogoxiang/utils =1.0.0 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVISTANBUL-16755114...

@antv/torch (>=1.0.0 <=1.0.6), @diogoxiang/utils (=1.0.0) potentially affected by unknown CVE via @antv/istanbul (=0.0.0)

@antv/istanbul NPM version =0.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/istanbul and may be impacted: - @antv/torch =1.0.0, =1.0.6 - @diogoxiang/utils =1.0.0 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVISTANBUL-16754945...

@diogoxiang/utils (=1.0.0) potentially affected by unknown CVE via @antv/torch (=1.0.6)

@antv/torch NPM version =1.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/torch and may be impacted: - @diogoxiang/utils =1.0.0 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVTORCH-16754422...