@antv/li-analysis-assets (>=1.0.0 <=1.9.1), @antv/li-core-assets (>=1.0.0 <=1.3.7) +3 more potentially affected by unknown CVE via @antv/li-sdk (=1.5.1)

@antv/li-sdk NPM version =1.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/li-sdk and may be impacted: - @antv/li-analysis-assets =1.0.0, =1.0.0, =1.0.0, =0.0.1, =0.0.2 Source cves: unknown CVE Source advisory: OSV:MAL-2026-4065...

Malicious code in @antv/li-editor (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...