MAL-2026-3873 Malicious code in @antv/dom-util (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-3862 Malicious code in @antv/color-util (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in @antv/color-util (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-4075 Malicious code in @antv/path-util (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

1g6table (=0.1.0), 7qb (=0.0.17) +1266 more potentially affected by unknown CVE via @antv/dom-util (>=2.0.2 <=2.0.4)

@antv/dom-util NPM version =2.0.2, =1.1.0, =0.1.1, =0.1.1, =0.1.0, =0.0.2, =0.1.2, =1.0.0, =0.2.0, =1.1.15, =1.0.4, =2.1.0 - @alifd/ice-devtools =1.1.14-beta.4 and more Source cves: unknown CVE Source advisory: SNYK:JS-ANTVDOMUTIL-16754419...

@2nova/wu-ui (>=1.1.0 <=1.3.12), @action.sustainability/storybook-dashboard (>=0.1.1 <=0.1.5) +824 more potentially affected by unknown CVE via @antv/color-util (=2.0.6)

@antv/color-util NPM version =2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/color-util and may be impacted: - @2nova/wu-ui =1.1.0, =0.1.1, =0.1.1, =0.1.0, =0.0.2, =0.1.2, =1.0.0, =1.1.15, =1.0.4, =0.1.5, =1.0.0, =0.0.1, =1.0.2,...

@2nova/wu-ui (>=1.1.0 <=1.3.12), @action.sustainability/storybook-dashboard (>=0.1.1 <=0.1.5) +824 more potentially affected by unknown CVE via @antv/color-util (=2.0.6)

@antv/color-util NPM version =2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/color-util and may be impacted: - @2nova/wu-ui =1.1.0, =0.1.1, =0.1.1, =0.1.0, =0.0.2, =0.1.2, =1.0.0, =1.1.15, =1.0.4, =0.1.5, =1.0.0, =0.0.1, =1.0.2,...

@antv/chart-advisor (>=1.1.4 <=1.1.7), @opd/ava (=1.0.0) +1 more potentially affected by unknown CVE via @antv/dw-util (=1.1.4)

@antv/dw-util NPM version =1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/dw-util and may be impacted: - @antv/chart-advisor =1.1.4, =1.0.0, =1.0.10 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVDWUTIL-16754899...

@action.sustainability/storybook-dashboard (>=0.1.1 <=0.1.5), @aliedu/vc-edu-components (>=1.1.15 <=1.1.24) +404 more potentially affected by unknown CVE via @antv/path-util (=3.0.1)

@antv/path-util NPM version =3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/path-util and may be impacted: - @action.sustainability/storybook-dashboard =0.1.1, =1.1.15, =0.1.0, =0.9.4-beta1, =0.0.1-beta.1, =0.0.1, =3.0.0, =3.0.0, =1.0.0,...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

1g6table (=0.1.0), 7qb (=0.0.17) +1356 more potentially affected by unknown CVE via @antv/matrix-util (>=3.0.4 <=3.1.0-beta.3)

@antv/matrix-util NPM version =3.0.4, =1.1.0, =0.1.1, =0.1.1, =0.1.0, =0.0.2, =0.1.2, =0.9.1, =1.0.0, =0.2.0, =1.1.15, =1.0.4, =2.1.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-ANTVMATRIXUTIL-16754473...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

1byte-react-design (>=1.7.1 <=1.14.0), 7qb (=0.0.17) +950 more potentially affected by unknown CVE via @antv/util (>=3.3.11 <=3.3.4)

@antv/util NPM version =3.3.11, =1.7.1, =1.0.0, =0.1.1, =0.1.2, =1.1.43, =5.0.48, =1.0.1, =1.1.15, =1.0.4, =1.0.5, =1.0.5, =1.0.5, =1.1.26, =1.3.19 and more Source cves: unknown CVE Source advisory: SNYK:JS-ANTVUTIL-16754357...

@antv/chart-advisor (>=1.1.4 <=1.1.7), @opd/ava (=1.0.0) +1 more potentially affected by unknown CVE via @antv/dw-util (=1.1.4)

@antv/dw-util NPM version =1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/dw-util and may be impacted: - @antv/chart-advisor =1.1.4, =1.0.0, =1.0.10 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVDWUTIL-16755068...

@action.sustainability/storybook-dashboard (>=0.1.1 <=0.1.5), @aliedu/vc-edu-components (>=1.1.15 <=1.1.24) +404 more potentially affected by unknown CVE via @antv/path-util (=3.0.1)

@antv/path-util NPM version =3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/path-util and may be impacted: - @action.sustainability/storybook-dashboard =0.1.1, =1.1.15, =0.1.0, =0.9.4-beta1, =0.0.1-beta.1, =0.0.1, =3.0.0, =3.0.0, =1.0.0,...

Security update for util-linux

This update for util-linux fixes the following issue CVE-2026-27456: TOCTOU in the mount program when setting up loop devices bsc1261606. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can r...

SUSE-SU-2026:1962-1 Security update for util-linux

This update for util-linux fixes the following issue - CVE-2026-27456: TOCTOU in the mount program when setting up loop devices bsc1261606...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference via the UERadioCapabilityCheckResponse function in the dispatcher.go file. An attacker can cause a denial of service by sending specially crafted remote requests that trigger a null pointer dereference...

Out-of-Bounds

Overview Affected versions of this package are vulnerable to Out-of-Bounds via an unknown function of the file ngap/dispatcher.go of the component NGAP Message Handler. The manipulation leads to memory corruption. The attack may be initiated remotely. The exploit is publicly available and might b...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference via the function RANConfiguration of the file ngap/handler.go. The manipulation results in null pointer dereference. The attack may be launched remotely. The exploit has been released to the public and may be us...