A sweeping supply chain attack has hit the npm ecosystem, compromising hundreds of widely used JavaScript packages tied to the @antv data visualization library.

The attack, which unfolded in the early hours of May 19, 2026, injected malicious code into packages used by millions of developers worldwide.

Among the affected packages is echarts-for-react, a popular React wrapper with roughly 1.1 million weekly downloads.

The attackers gained access to the npm maintainer account known as “atool” and used it to push poisoned versions of dozens of well-known packages.

Beyond the core @antv packages, the attack also reached unrelated packages such as timeago.js, size-sensor, and canvas-nest.js.

The sheer number of affected packages made this one of the largest npm supply chain incidents in recent memory.

This one is really, really bad.https://t.co/tfTfzGmgYD

Starting to be hard to call this one "Mini Shai-Hulud" https://t.co/utgugatkJa
— Adnan Khan (@adnanthekhan) May 19, 2026

Researchers at Socket.dev identified the attack in near real-time, flagging the malicious publish wave and classifying affected versions as known malware.

Socket.dev said in a report shared with Cyber Security News (CSN) that its internal review identified 639 compromised package versions across 323 unique packages in what the team labeled the “5/19 Mini Shai-Hulud wave”. Most detections happened within 6 to 12 minutes of publication.

Across the broader Mini Shai-Hulud campaign, Socket has tracked 1,055 versions across 502 unique packages spanning npm, PyPI, and Composer registries.

The npm ecosystem bears the overwhelming share, with 1,048 compromised versions across 498 unique npm packages. The campaign’s scale points to a coordinated and well-resourced threat actor operating across multiple open source ecosystems.

The blast radius here is significant. The publishing account is tied to packages used across data visualization, graphing, mapping, and React component development.

Even if only a fraction of those packages received a malicious update, organizations that automatically pull new dependency versions face real downstream exposure.

Hackers Compromise @antv Packages

The injected code follows a pattern tied to the Mini Shai-Hulud malware family. Each compromised package contains a root-level index.js file that modifies package.json to execute the payload at install time through a “preinstall” hook running on Bun.

The payload is heavily obfuscated using a large string-array lookup table and a custom decryptor to hide sensitive strings from basic inspection.

Once triggered, the malware collects and transmits stolen data over an encrypted channel. It serializes harvested information, compresses it with gzip, encrypts it with AES-256-GCM, and wraps the key with RSA-OAEP before sending everything to the command-and-control server.

GitHub search reveals a rapidly updating cluster of threat actor-created repositories (Source - Socket.dev) — GitHub search reveals a rapidly updating cluster of threat actor-created repositories (Source – Socket.dev)

This layered encryption makes it very difficult for defenders to recover stolen content from network traffic logs.

The payload hunts for high-value secrets across developer and CI/CD environments. It targets GitHub tokens, AWS credentials, Kubernetes service-account material, SSH private keys, Vault tokens, Docker authentication files, and database connection strings.

It also contains platform-specific logic for GitHub Actions, GitLab CI, Jenkins, CircleCI, AWS CodeBuild, and several others.

GitHub as a Fallback Exfiltration Channel

If the malware obtains a usable GitHub token, it shifts to a secondary method. It creates a new repository under the victim’s account and commits stolen data into files following a structured naming path.

This technique abuses GitHub as trusted infrastructure, making exfiltration far harder to detect and block. Public GitHub searches for a reversed campaign marker currently reveal roughly 1,900 repositories created by the threat actor.

These use Dune-inspired names such as “sayyadina-stillsuit-852” and “fremen-fedaykin-225,” and their descriptions carry the same reversed marker, confirming they belong to the campaign’s exfiltration network.

Beyond stealing secrets, the payload can also spread itself. It validates stolen npm credentials, enumerates packages the compromised account can publish, injects malicious code, and republishes the modified packages.

This worm-like behavior lets the attack jump between maintainer accounts without further effort from the attacker.

Developers and security teams should audit any recent updates from affected @antv and associated npm namespaces right away.

Organizations should rotate any secrets or credentials that may have passed through environments where these packages were recently installed. Reviewing CI/CD pipeline logs for unexpected GitHub repository creation activity is also strongly advised.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
Domain	`t[.]m-kosche[.]com`	Primary C2 exfiltration domain used by the malicious payload
URL	`https://t[.]m-kosche[.]com:443/api/public/otel/v1/traces`	Primary HTTPS exfiltration endpoint for harvested secrets
URL	`https://fulcio[.]sigstore[.]dev/api/v2/signingCert`	Sigstore Fulcio endpoint referenced in the payload
URL	`https://rekor[.]sigstore[.]dev/api/v1/log/entries`	Sigstore Rekor transparency log endpoint referenced in the payload
GitHub Marker	`niagA oG eW ereH :duluH-iahS`	Reversed campaign marker string found in threat actor GitHub repositories
GitHub Marker	`niaga og ew ereh :duluh-iahs`	Lowercase variant of the reversed campaign marker
GitHub Marker	`Shai-Hulud: Here We Go Again`	Decoded plaintext of the campaign marker
File Path Pattern	`results/results-*.json`	Path pattern used by the GitHub fallback exfiltration mechanism to store stolen data
Repository Pattern		Naming convention used for threat actor staging repositories
GitHub Repository	`sayyadina-stillsuit-852`	Observed threat actor repository used for exfiltration staging
GitHub Repository	`atreides-ornithopter-112`	Observed threat actor repository used for exfiltration staging
GitHub Repository	`harkonnen-phibian-552`	Observed threat actor repository used for exfiltration staging
GitHub Repository	`fremen-fedaykin-225`	Observed threat actor repository used for exfiltration staging
GitHub Repository	`kanly-lasgun-874`	Observed threat actor repository used for exfiltration staging
Secret Target	`GITHUB_TOKEN`	Environment variable actively harvested by the payload
Secret Target	`AWS_ACCESS_KEY_ID`	AWS credential targeted for theft by the payload
Secret Target	`AWS_SECRET_ACCESS_KEY`	AWS credential targeted for theft by the payload
Secret Target	`AWS_SESSION_TOKEN`	AWS session token targeted for theft
Secret Target	`KUBECONFIG`	Kubernetes configuration file targeted for theft
Secret Target	`VAULT_TOKEN`	HashiCorp Vault token targeted for theft
File	`index.js`	Root-level malicious payload file injected into compromised packages

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Hackers Compromise @antv Packages in Mini Shai-Hulud npm Attack Wave appeared first on Cyber Security News.