MAL-2026-3956 Malicious code in @antv/g-plugin-webgl-renderer (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

@antv/g-mobile-webgl (>=0.0.2 <=0.0.4-alpha.16), @antv/g-plugin-3d (>=1.0.0-alpha.1 <=1.0.24-alpha.16) +1 more potentially affected by unknown CVE via @antv/g-plugin-webgl-renderer (=1.0.26)

@antv/g-plugin-webgl-renderer NPM version =1.0.26 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/g-plugin-webgl-renderer and may be impacted: - @antv/g-mobile-webgl =0.0.2, =1.0.0-alpha.1, =1.0.0-alpha.0, =1.0.26-alpha.16 Source cves: unknown CV...