MAL-2026-4112 Malicious code in @antv/x6-react (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

@widget-js/mindmap (>=0.0.1 <=0.0.5), gulf_web_scs (>=1.0.0 <=1.0.6) potentially affected by unknown CVE via @antv/x6-react-shape (=3.0.1)

@antv/x6-react-shape NPM version =3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/x6-react-shape and may be impacted: - @widget-js/mindmap =0.0.1, =1.0.0, =1.0.6 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVX6REACTSHAPE-16755112...