Malicious code in @antv/x6-plugin-dnd (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

@aidps/canvas-flow (>=1.0.0 <=1.0.1), @antv/x6-plugin-stencil (>=2.1.4 <=2.1.5) +104 more potentially affected by unknown CVE via @antv/x6-plugin-dnd (>=2.0.4 <=2.1.1)

@antv/x6-plugin-dnd NPM version =2.0.4, =1.0.0, =2.1.4, =2.0.1, =0.0.1, =0.0.2, =0.0.4, =0.7.0, =0.0.3, =2.0.4, =0.0.27, =0.0.3, =0.3.24 and more Source cves: unknown CVE Source advisory: SNYK:JS-ANTVX6PLUGINDND-16754385...