antv

A threat actor compromised an @antv maintainer account and published malicious versions of widely used npm data-visualization packages. The malicious payload executes during npm install, targeting GitHub Actions environments to steal credentials from multiple platforms. The attack propagated through dependency chains, affecting downstream packages with millions of weekly downloads.