[SECURITY] Compromised @antv packages on npm

[socket-threat-research-team]

Summary

A compromised npm account (atool, i@hust.cc) has published malicious versions of a large number of packages associated with the @antv npm namespace.

This activity is part of a coordinated supply chain attack pattern Socket has labeled Mini Shai-Hulud, involving high-volume malicious publishes across packages tied to compromised maintainer accounts.

Affected packages

The compromise spans the entire antv ecosystem and several related packages outside the namespace. Known affected scopes/packages include, but are not limited to:

• @antv/g, @antv/g2, @antv/g2plot, @antv/g6, @antv/x6, @antv/s2, @antv/f2
• @antv/l7, @antv/graphin, @antv/data-set
• Related packages outside the namespace: echarts-for-react, timeago.js, size-sensor, canvas-nest.js

The full, continuously updated list of malicious package versions is tracked here: https://socket.dev/supply-chain-attacks/mini-shai-hulud

What the malware does

Each compromised version ships three additions that are not present in legitimate releases:

1. A preinstall hook in package.json that runs bun run index.js on npm install.
2. A heavily obfuscated index.js (~500 KB, single line) at the package root.
3. An optional dependency pinned to a GitHub commit hash, used as a secondary payload channel.

On install, the payload harvests credentials from the local environment and any cloud or CI context the install runs in:

• AWS credentials from environment variables, the EC2 instance metadata service (IMDSv2), STS AssumeRoleWithWebIdentity, and the AWS shared credentials/config files
• AWS Secrets Manager secrets and Systems Manager Parameter Store parameters across all standard regions
• Kubernetes secrets across reachable namespaces, using mounted service account tokens or kubeconfig
• GitHub Actions runner secrets, read directly from the Runner.Worker process
• Generic environment variables, npm tokens, GitHub/GitLab tokens, and a large list of credential files on Linux, macOS, and Windows (cloud SDK configs, SSH keys, browser data, shell history, dotfiles, etc.)

Harvested data is exfiltrated over HTTPS via fetch().