Over 320 NPM Packages Compromised in Mini Shai-Hulud Supply Chain Attack
A new supply chain attack, dubbed Mini Shai-Hulud, has compromised over 320 NPM packages, along with GitHub Actions and a VS Code extension. The attack involved the compromise of the NPM maintainer account 'atool', which has access to multiple packages in the @antv namespace. Malicious versions of these packages were published, affecting popular packages like echarts-for-react. The attack has impacted a wide range of applications and CI environments. Security researchers have tracked over 1,000 versions across various ecosystems, with NPM being the most affected. The attack involves a multi-stage infection chain, with payloads designed to steal credentials and achieve persistence. 
