criticalclosedpartial fix
Mini Shai-Hulud hits AntV / timeago.js npm ecosystem
› npm @antv/*, timeago.js, related packages under atool
Get an email when a new major security incident drops. No spam, unsubscribe any time.
- started
- May 19, 2026
- closed
- Jun 1, 2026
- CVEs
- none
- sources
- 1
## summary
May 2026 wave of Mini Shai-Hulud compromised packages across Alibaba’s AntV visualization ecosystem and timeago.js (via npm account atool). Payload harvested CI secrets from GitHub Actions runner memory and dumped credentials to public GitHub repos. StepSecurity documented the ongoing spread.
severity: Critical supply-chain worm
## affected
- Malicious versions published during May 2026 campaign window
## fixed in
- Remove malicious versions; rotate CI/cloud secrets; pin clean releases
## news & write-ups[1]
## notes & caveats
Earlier 2026 Shai-Hulud wave; separate from August CHAINDROP and October tensorlake.
