39 matches found
Malicious code in @antv/xflow-hook (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
Malicious code in @antv/xflow (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
Malicious code in @antv/xflow-diff (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
Malicious code in @antv/xflow-core (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
MAL-2026-4119 Malicious code in @antv/xflow-core (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
MAL-2026-4121 Malicious code in @antv/xflow-extension (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
MAL-2026-4118 Malicious code in @antv/xflow (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
MAL-2026-4120 Malicious code in @antv/xflow-diff (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
@0fan/designable-flow (>=0.0.5 <=0.1.2), @171h/x6 (=2.12.0) +196 more potentially affected by unknown CVE via @antv/x6-geometry (>=2.0.5 <=2.0.6-beta.18)
@antv/x6-geometry NPM version =2.0.5, =0.0.5, =1.0.0, =2.0.0, =2.0.2-beta.0, =2.0.1-beta.5, =2.0.1, =0.0.1, =0.0.1, =0.0.3, =0.6.1, =1.0.0, =0.0.2, =0.0.5 and more Source cves: unknown CVE Source advisory: SNYK:JS-ANTVX6GEOMETRY-16754343...
@action.sustainability/storybook-dashboard (>=0.1.1 <=0.1.5), @agentlab/ldkg-ui-charts (>=0.1.4 <=0.1.7) +172 more potentially affected by unknown CVE via @antv/xflow-hook (>=1.0.0 <=1.1.52)
@antv/xflow-hook NPM version =1.0.0, =0.1.1, =0.1.4, =1.1.15, =0.1.0, =1.3.0, =1.0.1, =1.0.0, =1.0.0, =1.0.0, =0.0.0, =1.0.0, =1.0.0, =0.2.0, =0.2.1 and more Source cves: unknown CVE Source advisory: SNYK:JS-ANTVXFLOWHOOK-16755077...
@antv/xflow-diff (=1.0.0), @equota/web-designer (>=0.0.4 <=0.0.11) +3 more potentially affected by unknown CVE via @antv/xflow (=2.2.4)
@antv/xflow NPM version =2.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/xflow and may be impacted: - @antv/xflow-diff =1.0.0 - @equota/web-designer =0.0.4, =0.0.1, =1.0.0, =0.1.0, =0.1.1 Source cves: unknown CVE Source advisory:...
@aidps/canvas-flow (>=1.0.0 <=1.0.1), @antv/xflow (>=2.0.1 <=2.2.4) +59 more potentially affected by unknown CVE via @antv/x6-plugin-minimap (>=2.0.5 <=2.0.7)
@antv/x6-plugin-minimap NPM version =2.0.5, =1.0.0, =2.0.1, =0.0.1, =0.0.4, =0.6.0, =2.0.4, =3.0.0, =3.5.1-alpha.3, =0.0.3, =0.2.2, =0.2.1, =1.0.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-ANTVX6PLUGINMINIMAP-16755067...
@action.sustainability/storybook-dashboard (>=0.1.1 <=0.1.5), @agentlab/ldkg-ui-charts (>=0.1.4 <=0.1.7) +168 more potentially affected by unknown CVE via @antv/xflow-core (>=1.0.0 <=1.1.52)
@antv/xflow-core NPM version =1.0.0, =0.1.1, =0.1.4, =1.1.15, =0.1.0, =1.3.0, =1.0.1, =1.0.0, =1.0.0, =0.0.0, =1.0.0, =1.0.0, =0.2.0, =1.1.0, =1.6.6 and more Source cves: unknown CVE Source advisory: SNYK:JS-ANTVXFLOWCORE-16754364...
@action.sustainability/storybook-dashboard (>=0.1.1 <=0.1.5), @agentlab/ldkg-ui-charts (>=0.1.4 <=0.1.7) +167 more potentially affected by unknown CVE via @antv/xflow-extension (>=1.0.0 <=1.1.52)
@antv/xflow-extension NPM version =1.0.0, =0.1.1, =0.1.4, =1.1.15, =0.1.0, =1.3.0, =1.0.1, =1.0.0, =0.0.0, =1.0.0, =1.0.0, =0.2.0, =1.1.0, =0.0.2, =0.0.33 and more Source cves: unknown CVE Source advisory: SNYK:JS-ANTVXFLOWEXTENSION-16754359...
@action.sustainability/storybook-dashboard (>=0.1.1 <=0.1.5), @agentlab/ldkg-ui-charts (>=0.1.4 <=0.1.7) +172 more potentially affected by unknown CVE via @antv/xflow-hook (>=1.0.0 <=1.1.52)
@antv/xflow-hook NPM version =1.0.0, =0.1.1, =0.1.4, =1.1.15, =0.1.0, =1.3.0, =1.0.1, =1.0.0, =1.0.0, =1.0.0, =0.0.0, =1.0.0, =1.0.0, =0.2.0, =0.2.1 and more Source cves: unknown CVE Source advisory: SNYK:JS-ANTVXFLOWHOOK-16754908...
EUVD-2006-1851
Malware in sbrugna...
EUVD-2006-1849
Malware in sbrugna...
EUVD-2006-1850
Malware in sbrugna...
Malicious code in xflow (npm)
The package xflow was found to contain malicious code...
MAL-2025-39762 Malicious code in xflow (npm)
The package xflow was found to contain malicious code...