Post

🚨 BREAKING: Socket is investigating an active npm supply chain attack compromising hundreds of packages in the @antv ecosystem. The malicious publish wave appears tied to Mini Shai-Hulud and packages connected to the npm maintainer account atool.

Socket

@socket.dev

19 May

This is a developing story. We’ve embedded the affected package list from Socket’s campaign page and will keep updating as more versions and payload details are confirmed. socket.dev/blog/antv-pa...

socket.devActive Supply Chain Attack Compromises @antv Packages on npm...Active npm supply chain attack compromises @antv packages in a fast-moving malicious publish wave tied to Mini Shai-Hulud.

Socket

@socket.dev

UPDATE: So far we've identified 639 compromised npm package versions across 323 unique packages in tonight’s Mini Shai-Hulud wave. That includes 558 versions across 279 unique @antv packages. Most were detected within ~6 minutes of publication. We also published our technical analysis.

19/5/26, 4:47 am6 reposts12 likes

Socket

@socket.dev

19 May

cc: @campuscodi.risky.biz @zackwhittaker.com @thehackernews.bsky.social @bleepingcomputer.com @theregister.com @heise.de @golemde.bsky.social

The Bear Radar 🎯

@stockmarketrotation.com

19 May

Catching those within six minutes is an impressive turnaround for that many packages. Was the antv volume coming from one specific account or was it more widespread?