# Mini Shai-Hulud npm Attack: AntV Ecosystem Compromise (May 2026)

DevFeed: [Mini Shai-Hulud npm Attack: AntV Ecosystem Compromise (May 2026)](<https://devfeed.tech/articles/mini-shai-hulud-npm-attack-antv-ecosystem-compromise-may-2026-13160.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/mini-shai-hulud-npm-attack-antv-ecosystem-compromise-may-2026>)

Published: 2026-05-19T00:00:00Z

Content type: news

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [npm packages](<https://devfeed.tech/topics/npm-packages.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [Data visualization](<https://devfeed.tech/topics/data-visualization.md>), [Aeternum](<https://devfeed.tech/topics/aeternum.md>), [stripe](<https://devfeed.tech/topics/stripe.md>), [Raycast extension](<https://devfeed.tech/topics/raycast-extension.md>), [React UI animations](<https://devfeed.tech/topics/react-ui-animations.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [antv](<https://devfeed.tech/tags/antv.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-npm](<https://devfeed.tech/tags/chainguard-npm.md>), [malware](<https://devfeed.tech/tags/malware.md>), [mini-shai-hulud](<https://devfeed.tech/tags/mini-shai-hulud.md>), [npm](<https://devfeed.tech/tags/npm.md>), [npm-malware](<https://devfeed.tech/tags/npm-malware.md>), [npm-packages](<https://devfeed.tech/tags/npm-packages.md>), [react](<https://devfeed.tech/tags/react.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>)

## AI overview

The article reports that a compromised npm maintainer account pushed malicious versions of 314 packages in Alibaba's AntV ecosystem on May 19, 2026. It describes the Mini Shai-Hulud campaign, which uses install hooks and obfuscated Bun scripts to deliver malware and harvest developer credentials.

## Source excerpt

The Mini Shai-Hulud npm worm compromised 314 packages in the AntV ecosystem on May 19, 2026 -- including echarts-for-react and timeago.js.