@action.sustainability/storybook-dashboard (>=0.1.1 <=0.1.5), @aliedu/vc-edu-components (>=1.1.15 <=1.1.24) +389 more potentially affected by unknown CVE via @antv/path-util (=3.0.1)

@antv/path-util NPM version =3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/path-util and may be impacted: - @action.sustainability/storybook-dashboard =0.1.1, =1.1.15, =0.1.0, =0.9.4-beta1, =0.0.1-beta.1, =0.0.1, =3.0.0, =3.0.0, =1.0.0,...

MAL-2026-4075 Malicious code in @antv/path-util (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in @antv/path-util (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...