Critical Vulnerabilities Found in @antv Packages After npm Attack
Key Takeaways A significant supply chain attack, dubbed “Mini Shai-Hulud,” compromised hundreds of npm JavaScript packages, including those related to the @antv data visualization...
Key Takeaways
- A significant supply chain attack, dubbed “Mini Shai-Hulud,” compromised hundreds of npm JavaScript packages, including those related to the @antv data visualization library.
- The attackers leveraged a compromised npm maintainer account (“atool”) to inject malicious code into 639 package versions across 323 unique packages, impacting millions of developers.
- The malware, active since May 19, 2026, is designed to steal sensitive credentials (e.g., GitHub tokens, AWS keys, Kubernetes secrets) from developer and CI/CD environments.
- A unique exfiltration method involves creating new GitHub repositories under victim accounts, making detection challenging. The malware also exhibits worm-like behavior to spread further.
- Immediate action is required from developers and organizations to audit dependencies, rotate compromised credentials, and monitor for suspicious GitHub activity.
Widespread Supply Chain Attack Targets npm Ecosystem, Compromising @antv Packages
In a far-reaching supply chain incident, malicious actors have infiltrated hundreds of popular JavaScript packages within the npm ecosystem, with a particular focus on those associated with the @antv data visualization library. The attack, which began on May 19, 2026, injected harmful code into packages utilized by millions of developers globally.
Table Of Content
Among the high-profile targets was echarts-for-react, a React wrapper with approximately 1.1 million weekly downloads. Threat actors compromised the npm maintainer account “atool” to push malicious versions of numerous well-known packages. The attack extended beyond core @antv packages to include unrelated projects such as timeago.js, size-sensor, and canvas-nest.js, making it one of the most extensive npm supply chain incidents in recent memory.
Real-Time Detection and Campaign Scope
Security researchers at Socket.dev identified the attack in near real-time, categorizing affected versions as known malware. Their internal analysis revealed 639 compromised package versions across 323 unique packages, which they termed the “5/19 Mini Shai-Hulud wave.” Most of these detections occurred within 6 to 12 minutes of publication.
The broader “Mini Shai-Hulud” campaign has tracked 1,055 versions across 502 unique packages spanning npm, PyPI, and Composer registries. The npm ecosystem accounts for the vast majority, with 1,048 compromised versions across 498 unique npm packages. This scale suggests a highly coordinated and well-resourced threat actor operating across multiple open-source platforms.
The impact is substantial, as the compromised publishing account is linked to packages crucial for data visualization, graphing, mapping, and React component development. Organizations that automatically fetch new dependency versions are at considerable risk of downstream exposure, even if only a fraction of these packages received a malicious update.
Malicious Payload and Exfiltration Techniques
The injected code aligns with the Mini Shai-Hulud malware family. Each compromised package contains a root-level index.js file designed to modify package.json. This modification incorporates a “preinstall” hook that executes the payload via Bun during installation. The payload itself is heavily obfuscated, employing an extensive string-array lookup table and a custom decryptor to conceal sensitive strings from basic analysis.
Upon execution, the malware collects and transmits stolen data through an encrypted channel. It serializes the harvested information, compresses it with gzip, encrypts it using AES-256-GCM, and then wraps the encryption key with RSA-OAEP before dispatching it to a command-and-control (C2) server. This multi-layered encryption significantly hinders defenders’ ability to recover stolen data from network traffic logs.
The payload actively seeks high-value secrets within developer and CI/CD environments. It specifically targets GitHub tokens, AWS credentials, Kubernetes service-account details, SSH private keys, Vault tokens, Docker authentication files, and database connection strings. Furthermore, it includes platform-specific logic tailored for environments like GitHub Actions, GitLab CI, Jenkins, CircleCI, and AWS CodeBuild, among others.
GitHub as a Covert Exfiltration Channel
If the malware successfully obtains a usable GitHub token, it switches to a secondary, more stealthy exfiltration method. It creates a new repository under the victim’s GitHub account and commits the stolen data into files following a structured naming convention. This technique exploits GitHub’s trusted infrastructure, making the exfiltration process much harder to detect and block.
Public GitHub searches for a specific reversed campaign marker currently reveal approximately 1,900 repositories created by the threat actor. These repositories use “Dune”-inspired names like “sayyadina-stillsuit-852” and “fremen-fedaykin-225,” and their descriptions contain the same reversed marker, confirming their association with the campaign’s exfiltration network.
Beyond data theft, the payload also possesses self-propagation capabilities. It validates stolen npm credentials, identifies packages the compromised account can publish, injects its malicious code, and then republishes the altered packages. This worm-like behavior allows the attack to spread autonomously across maintainer accounts without further direct intervention from the attackers.
What You Should Do
- Audit Dependencies: Immediately review all recent updates from @antv and associated npm namespaces. Identify any compromised package versions and roll back to safe versions.
- Rotate Credentials: Assume compromise for any secrets or credentials (GitHub tokens, AWS keys, SSH keys, Vault tokens, etc.) that may have been present in environments where these malicious packages were installed. Rotate all affected credentials without delay.
- Monitor CI/CD Pipelines: Scrutinize CI/CD pipeline logs for any anomalous activity, particularly unexpected GitHub repository creation or unusual outbound network connections.
- Implement Strict Access Controls: Enforce the principle of least privilege for npm accounts and other development tooling. Consider multi-factor authentication (MFA) for all critical accounts.
- Enhance Supply Chain Security: Utilize security tools that can analyze package dependencies for known vulnerabilities and suspicious behavior during installation.
No Comment! Be the first one.