Zero-Day Vulnerability Alert

This page summarizes the AntV npm supply chain compromise associated with the ongoing “Mini Shai-Hulud” campaign.

The incident involved compromised npm packages published under the @antv/* namespace, along with additional npm packages. The compromised packages reportedly included mechanisms for credential harvesting, GitHub-based exfiltration, and further supply-chain propagation via malicious package publishing. .

You can use this page to identify affected package versions and review recommended remediation actions.

For additional background and technical details, please refer to: “Snyk Blog Post”

Packages affected by zero-day vulnerabilities

Showing 30 of 323 • Page 1 of 11

- C
Embedded Malicious Code in @starmind/collector-cli (npm)
Versions: 0.3.10
- C
Embedded Malicious Code in @antv/g-image-exporter (npm)
Versions: 1.2.42, 1.1.42
- C
Embedded Malicious Code in @antv/g2 (npm)
Versions: 5.6.8, 5.5.8
- C
Embedded Malicious Code in @antv/g2plot (npm)
Versions: 2.6.35, 2.5.35
- C
Embedded Malicious Code in @antv/s2 (npm)
Versions: 2.9.1, 2.8.1
- C
Embedded Malicious Code in @antv/li-p2 (npm)
Versions: 1.10.2, 1.9.2
- C
Embedded Malicious Code in @antv/smart-color (npm)
Versions: 0.4.1, 0.3.1
- C
Embedded Malicious Code in @antv/s2-react (npm)
Versions: 2.5.1, 2.4.1
- C
Embedded Malicious Code in @antv/li-sdk (npm)
Versions: 1.7.1, 1.6.1
- C
Embedded Malicious Code in @antv/l7-extension-g-layer (npm)
Versions: 1.2.0, 1.1.0
- C
Embedded Malicious Code in @antv/f6-alipay (npm)
Versions: 0.2.7, 0.1.7
- C
Embedded Malicious Code in ribbon.js (npm)
Versions: 1.1.2
- C
Embedded Malicious Code in @antv/g-webgpu-unitchart (npm)
Versions: 0.7.1, 0.6.1
- C
Embedded Malicious Code in @antv/g-plugin-webgpu-device (npm)
Versions: 1.11.17, 1.10.17
- C
Embedded Malicious Code in @antv/gi-common-components (npm)
Versions: 1.5.16, 1.4.16
- C
Embedded Malicious Code in @antv/torch (npm)
Versions: 1.2.6, 1.1.6
- C
Embedded Malicious Code in @antv/g-plugin-svg-renderer (npm)
Versions: 2.6.1, 2.5.1
- C
Embedded Malicious Code in @antv/g-plugin-svg-picker (npm)
Versions: 2.2.46, 2.1.46
- C
Embedded Malicious Code in @antv/g2-ssr (npm)
Versions: 0.4.0, 0.3.0
- C
Embedded Malicious Code in @antv/vis-predict-engine (npm)
Versions: 0.3.1, 0.2.1
- C
Embedded Malicious Code in @antv/l7-map (npm)
Versions: 2.27.10, 2.26.10
- C
Embedded Malicious Code in @antv/g-plugin-canvas-path-generator (npm)
Versions: 2.3.26, 2.2.26
- C
Embedded Malicious Code in @antv/x6-plugin-export (npm)
Versions: 2.3.6, 2.2.6
- C
Embedded Malicious Code in @antv/l7-pass (npm)
Versions: 1.2.0, 1.1.0
- C
Embedded Malicious Code in @antv/g-plugin-canvaskit-renderer (npm)
Versions: 2.5.1, 2.4.1
- C
Embedded Malicious Code in @antv/g-dom-mutation-observer-api (npm)
Versions: 2.2.42, 2.1.42
- C
Embedded Malicious Code in @antv/g2-brush (npm)
Versions: 0.2.2, 0.1.2
- C
Embedded Malicious Code in @antv/geo-coord (npm)
Versions: 1.2.8, 1.1.8
- C
Embedded Malicious Code in @antv/gi-sdk-app (npm)
Versions: 1.4.10, 1.3.10
- C
Embedded Malicious Code in @antv/g-plugin-box2d (npm)
Versions: 2.3.1, 2.2.1

Page 1 of 11