Skip to content
Tech News
← Back to articles

New Shai-Hulud malware wave compromises 600 npm packages

2026-05-19 | original
read original get NPM Package Security Scanner → more articles
Why This Matters

The recent wave of Shai-Hulud malware attacks on over 600 npm packages highlights the growing threat of supply chain compromises in the tech industry. These attacks not only jeopardize the security of countless developer environments but also demonstrate the increasing sophistication of threat actors exploiting open-source ecosystems to exfiltrate sensitive data. This underscores the urgent need for improved security practices and monitoring within software development pipelines to protect both consumers and organizations.

Key Takeaways

Threat actors earlier today published more than 600 malicious packages to the Node Package Manager (npm) index as part of a new Shai-Hulud supply-chain campaign.

Most of the affected packages are in the @antv ecosystem, which include libraries for charting, graph visualization, building flowcharts, and mapping. However, popular packages outside this namespace have also been compromised.

As in the previous Shai-Hulud campaign impacting TanStack and Mistral packages, the payload collects secrets from developer and CI/CD environments and exfiltrates them over the Session P2P network to complicate detection and takedown efforts.

The threat actor also used GitHub as a fallback exfiltration mechanism and published stolen data in repositories under victims' accounts, when tokens used for publishing were found.

According to application security company Socket, the hackers published 639 malicious versions across 323 unique packages in about one hour. Some of the impacted libraries include:

echarts-for-react

@antv/g2

@antv/g6

@antv/x6

@antv/l7

... continue reading

Explore topics: shai-hulud npm @antv github package security
Related:
Hackers have compromised dozens of popular open source packages in an ongoing supply chain attack
US cyber agency CISA exposed reams of passwords and cloud keys to the open web
U.S. Cybersecurity Agency Leaves Its Digital Keys Out in Public on GitHub
Show HN: Id-agent – Token efficient UUID alternative for AI agents
CISA Admin Leaked AWS GovCloud Keys on GitHub

© 2026 GoKawiil

About | Editorial Policy | Contact