npm Supply Chain Attack Wave Mini Shai-Hulud Compromises @antv Ecosystem Packages

Cybersecurity researchers have discovered a fresh software supply chain attack campaign targeting npm packages in the @antv ecosystem. The attack, part of the ongoing Mini Shai‑Hulud wave, compromised packages tied to the npm maintainer account atool, including echarts-for-react. The affected package, a widely used React wrapper for Apache ECharts, has roughly 1.1 million weekly installs. Attackers injected malicious code into the package distribution, potentially compromising downstream projects.

The compromised code could allow attackers to execute arbitrary scripts in projects that depend on the package. Maintainers have released a clean version and urged users to update. Developers should audit their dependencies for the affected packages and apply the latest patch. Failure to update could expose applications to code injection and data exfiltration.