# Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account

DevFeed: [Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account](<https://devfeed.tech/articles/mini-shai-hulud-hits-antv-300-malicious-npm-packages-published-via-compromised-maintainer-account-8015.md>)

Original publisher: [Read original article](<https://snyk.io/blog/mini-shai-hulud-antv-npm-supply-chain-attack/>)

Author: Liran Tal

Published: 2026-05-18T23:00:00Z

Content type: article

Language: en

Sources: [Blog RSS Feed | Snyk](<https://devfeed.tech/sources/blog-rss-feed-snyk.md>)

Topics: [Data visualization](<https://devfeed.tech/topics/data-visualization.md>), [npm packages](<https://devfeed.tech/topics/npm-packages.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [npm](<https://devfeed.tech/topics/npm.md>), [C2](<https://devfeed.tech/topics/c2.md>), [Bun](<https://devfeed.tech/topics/bun.md>), [JavaScript](<https://devfeed.tech/topics/javascript.md>), [GitHub](<https://devfeed.tech/topics/github.md>)

Tags: [awareness](<https://devfeed.tech/tags/awareness.md>), [blog](<https://devfeed.tech/tags/blog.md>), [c2](<https://devfeed.tech/tags/c2.md>), [data-visualization](<https://devfeed.tech/tags/data-visualization.md>), [developer](<https://devfeed.tech/tags/developer.md>), [devops](<https://devfeed.tech/tags/devops.md>), [devrel](<https://devfeed.tech/tags/devrel.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [malware](<https://devfeed.tech/tags/malware.md>), [npm-packages](<https://devfeed.tech/tags/npm-packages.md>), [payload](<https://devfeed.tech/tags/payload.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [security](<https://devfeed.tech/tags/security.md>), [snyk-open-source](<https://devfeed.tech/tags/snyk-open-source.md>), [snyk-platform](<https://devfeed.tech/tags/snyk-platform.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>), [teampcp](<https://devfeed.tech/tags/teampcp.md>), [tokens](<https://devfeed.tech/tags/tokens.md>)

## AI overview

This article analyzes the Mini Shai-Hulud supply-chain attack targeting the AntV data visualization ecosystem through a compromised npm maintainer account. It describes the mass publication of malicious package versions, the embedded Bun payload, credential and secret theft, C2 persistence, and self-propagation using stolen npm tokens.

## Source excerpt

A compromised npm maintainer account triggered an automated burst of over 300 malicious package versions across 323 packages in the AntV data visualization ecosystem, part of the ongoing Mini Shai-Hulud supply chain worm campaign. Here's what the malware does, how to detect exposure, and how to respond.