Mini Shai-Hulud: 320+ NPM Packages Hit by Supply Chain Attack

Over 320 NPM packages under the @antv namespace have been compromised in a new supply chain attack, dubbed “Mini Shai-Hulud” by SecurityWeek. The attackers leveraged a compromised maintainer account to publish malicious versions of these packages, injecting a significant risk into countless downstream projects.

This incident highlights a critical attack vector: developer account compromise. Once an attacker gains control of a legitimate maintainer account, they can push malicious code that bypasses standard repository checks, directly impacting any project that depends on these packages. It’s a highly effective way to spread malware widely and rapidly.

Attackers are consistently targeting the software supply chain because it offers a force multiplier. Compromising one key maintainer or package allows them to poison hundreds, if not thousands, of applications. This makes the initial account compromise a high-value target for sophisticated threat actors looking for maximum impact with minimal effort.