Malicious code in @antv/x6-plugin-scroller (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

@antv/xflow (>=2.0.1 <=2.2.4), @antv/xflow-diff (=1.0.0) +50 more potentially affected by unknown CVE via @antv/x6-plugin-scroller (>=2.0.10 <=2.0.9)

@antv/x6-plugin-scroller NPM version =2.0.10, =2.0.1, =0.0.1, =0.0.4, =1.2.0, =1.12.1, =2.0.4, =0.0.27, =3.0.0, =3.3.1-alpha.2, =0.0.1-alpha.6, =0.0.9, =0.1.8 and more Source cves: unknown CVE Source advisory: SNYK:JS-ANTVX6PLUGINSCROLLER-16754447...