Mini Shai Hulud: Compromised @antv npm packages enable CI/CD credential theft

A sophisticated supply chain attack compromised popular @antv npm packages, deploying an obfuscated multi-platform malware that silently steals CI/CD credentials—including GitHub, AWS, and Kubernetes secrets—during npm installs, threatening thousands of downstream projects and cloud environments before being contained.