Compromised npm Maintainer Account Spread Credential-Stealing Malware Across AntV and timeago.js

Attackers abused the npm account atool—linked to the maintainer of timeago.js and with publish rights across Alibaba’s AntV ecosystem—to push malicious releases into widely used JavaScript packages. Reporting from StepSecurity, SafeDep, Aikido Security, and CSO indicates the campaign affected packages including timeago.js, echarts-for-react, size-sensor, and numerous @antv/* libraries used for charting, graphing, rendering, mapping, and spreadsheet functions in web applications and dashboards.

Researchers said the attacker published malicious code at scale, with one account citing 637 malicious versions across 317 packages in about 22 minutes, while another identified 143 compromised packages with affected versions. The payload was described as a CI/CD credential stealer and linked by some researchers to the Mini-Shai-Hulud worm, raising concern because the infected packages are commonly pulled into front-end builds and automated pipelines such as GitHub Actions, GitLab CI, and Kubernetes-hosted CI systems, where exposed tokens and cloud credentials could enable broader downstream compromise.