Malicious code in @antv/l7-composite-layers (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

@antv/ava (=3.6.0-alpha.0), @antv/gpt-vis (>=0.0.1 <=0.6.1) +23 more potentially affected by unknown CVE via @antv/l7-composite-layers (>=0.0.1-alpha.6 <=0.17.1)

@antv/l7-composite-layers NPM version =0.0.1-alpha.6, =0.0.1, =0.1.0, =0.0.1, =0.0.1-alpha.1, =0.1.1, =1.0.0, =1.0.2, =1.0.2, =0.0.1, =0.0.1, =1.0.0-alpha.4, =1.0.0-alpha.5 and more Source cves: unknown CVE Source advisory: OSV:MAL-2026-4035...