Massive npm Supply Chain Attack Hits AntV Ecosystem; Hundreds of JavaScript Packages Compromised

A major npm supply-chain compromise tied to the AntV ecosystem and linked to the 'Mini Shai-Hulud' campaign resulted in malicious versions being published for over 300 packages (including widely used libraries) in a short window; payloads reportedly steal AWS/GitHub/npm credentials, SSH keys, Docker/Kubernetes secrets, attempt container escapes, and propagate across developer workflows, prompting urgent guidance to audit dependencies, pin safe versions, rotate exposed credentials, and run installs with --ignore-scripts.