Mini Shai-Hulud strikes again: npm worm compromises hundreds of @antv packages

Mini Shai-Hulud is an active npm supply-chain campaign that injected obfuscated install-time JavaScript (root-level index.js and exotic GitHub deps) into hundreds of packages—including @antv, echarts-for-react, and timeago.js—to harvest CI/developer secrets (tokens, SSH keys, cloud creds), exfiltrate them (including committing to attacker-created GitHub repos), propagate by republishing compromised packages with stolen npm tokens, and persist via modifications to .vscode/tasks.json and .claude/settings.json; over 2,700 rogue GitHub repositories have been observed.