people · May 20, 2026

Snyk Highlights Large-Scale Malware Campaign Targeting AntV Ecosystem

Snyk published details of a malware campaign on May 19, 2026. The attack deployed more than 300 malicious package versions across 323 packages in a 22-minute automated burst. The packages targeted the AntV ecosystem and harvested developer secrets along with cloud credentials. One malicious package cloned the open-source Shai-Hulud malware released by TeamPCP the prior week. Snyk identified the vector as a compromised npm maintainer account.