Hackers Compromise @antv Packages in Mini Shai-Hulud npm Attack Wave
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
A sweeping supply chain attack has hit the npm ecosystem, compromising hundreds of widely used JavaScript packages tied to the @antv data visualization library. <\/p>\n
The attack, which unfolded in the early hours of May 19, 2026, injected malicious code into packages used by millions of developers worldwide. <\/p>\n
Among the affected packages is echarts-for-react, a popular React wrapper with roughly 1.1 million weekly downloads.<\/a><\/p>\n The attackers gained access to the npm maintainer account known as \u201catool\u201d and used it to push poisoned versions of dozens of well-known packages. <\/p>\n Beyond the core @antv packages, the attack also reached unrelated packages such as timeago.js, size-sensor, and canvas-nest.js. <\/p>\n The sheer number of affected packages made this one of the largest npm supply chain incidents in recent memory.<\/p>\n