@antv/chart-advisor (>=1.0.0 <=1.1.7), @antv/chart-linter (>=1.1.5 <=1.1.6) +3 more potentially affected by unknown CVE via @antv/dw-analyzer (=1.1.5)

@antv/dw-analyzer NPM version =1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/dw-analyzer and may be impacted: - @antv/chart-advisor =1.0.0, =1.1.5, =1.0.0, =1.0.0, =1.0.10 Source cves: unknown CVE Source advisory: OSV:MAL-2026-3875...

Malicious code in @antv/chart-linter (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-3857 Malicious code in @antv/chart-linter (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

@antv/chart-linter (>=1.1.5 <=1.1.6), @dljsbook/data (>=0.3.2 <=0.6.1) +50 more potentially affected by CVE-2019-10806 via vega-util (>=1.10.0 <=1.12.2)

vega-util NPM version =1.10.0, =1.1.5, =0.3.2, =0.6.0, =0.0.4, =1.0.0, =0.8.0, =1.0.0-alpha.4, =0.0.0-placeholder, =0.2.4, =0.4.3-dev9, =1.0.0, =1.4.0, =5.0.0, =6.0.2-alpha.0 and more Source cves: CVE-2019-10806 Source advisory: OSV:GHSA-6HWH-RQWF-CXXR...