Hacker greifen Antv-Pakete in Mini-Shai-Hulud-Npm-Attacke an

Among the affected packages is echarts-for-react, a popular React wrapper with roughly 1.1 million weekly downloads. The attackers gained access to the npm maintainer account known as “atool” and used it to push poisoned versions of dozens of well-known packages.

Beyond the core @antv packages, the attack also reached unrelated packages such as timeago.js, size-sensor, and canvas-nest.js. The sheer number of affected packages made this one of the largest npm supply chain incidents in recent memory. This one is really, really bad.

Starting to be hard to call this one "Mini Shai-Hulud" Researchers at Socket.dev identified the attack in near real-time, flagging the malicious publish wave and classifying affected versions as known malware. Socket.dev said in a report shared with