AntV / timeago.js: npm account 'atool' used to publish Mini Shai-Hulud worm to @antv/* and others (no CVE)
Severity: critical · Patch status: unknown · Since 2026-05-19
On 19 May 2026 malicious versions were published through the npm account 'atool' (maintainer of timeago.js and a member of the AntV team), hitting @antv/ packages, echarts-for-react, timeago-react, jest-canvas-mock, mcp-echarts and others; StepSecurity counted several hundred versions and the list was still growing. The payload, a Mini Shai-Hulud variant run with Bun, is delivered either by a preinstall/postinstall script or by an optionalDependencies entry pointing at a commit in the antvis/G2 repository whose prepare hook runs it. It reads the GitHub Actions Runner.Worker process memory for masked secrets, collects credentials from 130+ file paths, exfiltrates via GitHub dead-drop repositories (over 2,000 created) and a fallback host t.m-kosche.com, and persists through .claude/settings.json, .vscode/tasks.json and an injected codeql.yml workflow, plus a passwordless sudo rule for the runner user. It is a separate wave from the 11 May TanStack compromise by the same toolkit. The same payload was later re-published byte-for-byte in September 2026 (see the tensorlake record).
What to do
- Check lockfiles for the @antv/*, echarts-for-react, timeago.js, size-sensor versions in StepSecurity's list; note caret ranges can resolve to a malicious higher version
- Treat hosts and CI runners that installed them as compromised: rotate developer and CI secrets, GitHub and npm tokens
- Remove persistence: .claude/settings.json and .vscode/tasks.json hooks, unexpected codeql.yml workflows, sudoers entries for 'runner'
- Block t.m-kosche.com and look for dead-drop activity involving antvis/G2
- Use a package release cooldown / minimum age for new versions
Sources
All live incidents on Threat Watch
