MAL-2026-3840 Malicious code in @antv/x6-geometry (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

@0fan/designable-flow (>=0.0.5 <=0.1.2), @171h/x6 (=2.12.0) +197 more potentially affected by unknown CVE via @antv/x6-geometry (>=2.0.5 <=2.0.6-beta.18)

@antv/x6-geometry NPM version =2.0.5, =0.0.5, =1.0.0, =2.0.0, =2.0.2-beta.0, =2.0.1-beta.5, =2.0.1, =0.0.1, =0.0.1, =0.0.3, =0.6.1, =1.0.0, =0.0.2, =0.0.5 and more Source cves: unknown CVE Source advisory: SNYK:JS-ANTVX6GEOMETRY-16754343...