TeamPCP Compromises AntV and 322 Other NPM Packages

TeamPCP compromised npm maintainer accounts `atool` and `prop` and republished 324 packages (645 republished versions) in two tight waves on 2026-05-19, potentially exposing ~16 million weekly downloads (notably jest-canvas-mock, size-sensor, echarts-for-react) to malicious payloads; the report includes timelines, high-risk package lists, IOCs, and immediate remediation advice (pin known-good versions, audit lockfiles/CI caches, block install scripts, rotate credentials).