AI Summary

A fast‑moving malware attack on npm targeted the AntV enterprise data‑visualization tool on May 19. The attackers compromised the credentials of maintainer atool (i@hust.cc), who publishes timeago.js and holds rights to a large catalog of packages. In a 22‑minute burst, the attacker published 637 malicious versions across 317 npm packages, including popular tools such as size‑sensor, echarts‑for‑react, @antv/scale, and timeago.js. The breach compromised a significant portion of Alibaba’s AntV namespace, a platform used to build dashboards, user interfaces, and interactive applications across Asia, the US, and Europe.

AI summaries can be wrong sometimes—always verify important details using the source article.