Mini Shai Hulud Campaign Hits AntV npm Packages, Echarts-for-React Affected
The Mini Shai Hulud campaign continues its aggressive activity, now targeting AntV’s npm libraries. Cyber News - Erez Dasa reports that this includes the echarts-for-react library, which boasts 1.1 million weekly downloads. This is a fast-moving malicious publish wave, indicating a sophisticated supply chain attack.
This incident highlights a critical vulnerability in the software supply chain: developers often rely on widely used open-source packages without fully vetting their integrity. Attackers know this and consistently target popular libraries to maximize their reach. A single compromised dependency can ripple through countless downstream applications, enabling broad-scale distribution of malicious code.
For defenders, this means shifting focus beyond perimeter defenses to deeper scrutiny of build pipelines and third-party dependencies. Assume compromise in your upstream; verify everything. The attacker’s calculus here is simple: hit a widely used component, and you gain access to a massive user base with minimal effort.
What This Means For You
- If your organization uses any AntV npm packages, especially `echarts-for-react`, assume they are compromised. Immediately audit your build systems and deployed applications for recent package updates or suspicious activity related to these libraries. Verify package integrity against known good hashes and be prepared to roll back to earlier, uncompromised versions or implement strict dependency pinning.
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
Supply Chain Compromise - AntV npm Packages
Written by SCW Threat Desk