Cybersecurity · 58 views
AntV data visualization tool the latest to be hit by ongoing npm supply chain attacks
The world’s largest open-source registry, node package manager (npm), has been hit by another fast-moving malware attack, this time targeting the widely-used AntV enterprise data visualization tool.
AI Summary
A fast‑moving malware attack on npm compromised the AntV enterprise data visualization tool on May 19. The attacker hijacked a high‑value maintainer account (atool i@hust.cc) that publishes the timeago.js library and has publishing rights to dozens of popular packages, including size‑sensor, echarts‑for‑react, @antv/scale and timeago.js. Within a 22‑minute window the intruder released at least 637 malicious versions across 317 npm packages, affecting a large portion of Alibaba’s AntV namespace, which is used globally to build dashboards and interactive applications.
AI summaries can be wrong sometimes—always verify important details using the source article.
How AI & Automation are usedMore from Cybersecurity
Continue reading recent Cybersecurity coverage
- Maritime Coalition Launches Free Vulnerability Database for Ship and Port SystemsContinue reading
- Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth WeaknessesContinue reading
- CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code ExecutionContinue reading
- OpenAI’s August fix for theft of reasoning traces was quickly bypassedContinue reading
Support HappeningNow
Independent AI-powered news analysis is reader-supported. Your contribution helps cover infrastructure, summaries, and continued platform development.
Support HappeningNow