Active Supply Chain Attack Compromises @antv Packages on npm

A coordinated supply chain attack has compromised hundreds of popular npm packages—including the @antv ecosystem—injecting credential-stealing malware that targets developer and CI/CD secrets, posing widespread risk to organizations that automatically update dependencies.