MSC-2026-5740

Active npm supply chain attack compromises hundreds of packages tied to the @antv ecosystem in a large-scale malicious publish wave linked to the ongoing Mini Shai-Hulud campaign. The attack impacts widely used visualization and React-related packages, including @antv/g2, @antv/g6, @antv/x6,...

Mini Shai Hulud: Compromised @antv npm packages enable CI/CD credential theft

In this article 1. Attack chain overview 1. Technical analysis 2. How GitHub took action to prevent further harm 2. Mitigation and protection guidance 1. Microsoft Defender XDR Detections 2. Microsoft Defender XDR Threat analytics 3. Advanced hunting 4. Indicators of Compromise IOC 3. References ...

Malware in echarts-for-react

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MSC-2026-5736

Active npm supply chain attack compromises hundreds of packages tied to the @antv ecosystem in a large-scale malicious publish wave linked to the ongoing Mini Shai-Hulud campaign. The attack impacts widely used visualization and React-related packages, including @antv/g2, @antv/g6, @antv/x6,...

MSC-2026-5739

Active npm supply chain attack compromises hundreds of packages tied to the @antv ecosystem in a large-scale malicious publish wave linked to the ongoing Mini Shai-Hulud campaign. The attack impacts widely used visualization and React-related packages, including @antv/g2, @antv/g6, @antv/x6,...

MSC-2026-5738

Active npm supply chain attack compromises hundreds of packages tied to the @antv ecosystem in a large-scale malicious publish wave linked to the ongoing Mini Shai-Hulud campaign. The attack impacts widely used visualization and React-related packages, including @antv/g2, @antv/g6, @antv/x6,...

MSC-2026-5737

Active npm supply chain attack compromises hundreds of packages tied to the @antv ecosystem in a large-scale malicious publish wave linked to the ongoing Mini Shai-Hulud campaign. The attack impacts widely used visualization and React-related packages, including @antv/g2, @antv/g6, @antv/x6,...

Mini Shai-Hulud Pushes Malicious AntV npm Packages via Compromised Maintainer Account

Cybersecurity researchers have discovered a fresh software supply chain attack campaign that has compromised various npm packages associated with the @antv ecosystem as part of the ongoing Mini Shai-Hulud attack wave. "The attack affects packages tied to the npm maintainer account atool, includin...

MAL-2026-4132 Malicious code in echarts-for-react (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in echarts-for-react (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...