Malicious code in @antv/dipper-component (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-3870 Malicious code in @antv/dipper-component (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

@antv/dipper (>=0.0.3 <=0.0.4), @antv/dipper-widgets (>=0.0.2 <=0.0.4) potentially affected by unknown CVE via @antv/dipper-component (>=0.0.2 <=0.0.4)

@antv/dipper-component NPM version =0.0.2, =0.0.3, =0.0.2, =0.0.4 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVDIPPERCOMPONENT-16754388...