NewsPublished 20 May 2026

Over 320 NPM Packages Hit by Fresh Mini Shai-Hulud Supply Chain Attack

Source SecurityWeek

Description

A compromised maintainer account was used to publish malicious package versions across the @antv namespace. The post Over 320 NPM Packages Hit by Fresh Mini Shai-Hulud Supply Chain Attack appeared first on SecurityWeek .

Impact

The attack compromises the integrity of over 320 NPM packages, including popular ones with millions of weekly downloads, potentially affecting a broad range of applications and CI environments. It enables attackers to steal sensitive credentials and secrets from CI/CD pipelines and cloud environments, achieve persistence on infected systems, and maintain remote code execution capabilities. The supply chain compromise can propagate malicious code downstream to dependent projects, increasing the attack surface. The campaign also impacts GitHub Actions and VS Code extensions, further broadening potential exposure. No known exploits in the wild are reported yet, but the scale and sophistication indicate a significant medium-level threat to software supply chain security.

Defensive guidance

Organizations using packages from the @antv namespace or related affected ecosystems should monitor official advisories from package maintainers and security researchers. Immediate mitigation steps include auditing dependencies for suspicious versions, removing or replacing compromised packages, and rotating any exposed credentials or secrets in CI/CD and cloud environments. Given the attack's ability to exfiltrate secrets and persist, affected environments should be thoroughly investigated for signs of compromise. Vendors managing package registries and CI/CD platforms should be consulted for updates and protective measures.

References

securityweek.com/over-320-npm-packages-hit-by-fresh-mini-shai-hulud-supply-chain-attack/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 20 May 2026, 11:18 UTC

References

Community reviews