Active Supply Chain Attack Compromises Packages on npm

An active npm supply chain attack has compromised packages in the @antv ecosystem, affecting the maintainer account 'atool'. The attack is part of the Mini Shai-Hulud campaign, involving 639 compromised package versions across 323 unique packages. Notable affected packages include echarts-for-react with 1.1 million weekly downloads, and widely-used @antv packages for data visualization. The malware uses obfuscated install-time payloads that harvest developer credentials, GitHub tokens, npm tokens, AWS credentials, and other secrets from development and CI/CD environments. Stolen data is encrypted with AES-256-GCM and exfiltrated to a command-and-control server, with GitHub repositories used as fallback channels. The malware contains worm-like functionality to republish compromised packages and propagate through the npm ecosystem.

• LiteLLM supply chain compromiseCampaign2026-10-22
• TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing AttackCampaign2026-10-08
• Inside Coruna and DarkSword Chains: From Web Lures to iOS ExploitationMalware2026-10-29
• False Protection, Emptied Accounts: The Seven Android Trojan Families Targeting Indian Banking AppsMalware2026-10-28
• SkyW4lker Phishing Kit: Microsoft 365 Threat to US FirmsMalware2026-10-27