AntV npm Packages Hit in Coordinated Malware Wave

On July 28, 2026, malicious code was flagged in eight packages published under the @antv npm scope, the data-visualization suite maintained under Ant Group's open-source organization, alongside at least sixteen other npm packages and one PyPI package. Every entry was rated critical. The @antv packages are what turn this from a pile of throwaway typosquats into a real supply chain problem. AntV libraries sit deep inside dashboards, mapping tools, and internal analytics apps, so a single poisoned release can reach projects that never installed it directly.

This is the AntV npm compromise, and it landed in the middle of a summer of near-daily npm registry attacks. Below is what we can confirm, which package names to look for, and the exact commands to check a build.

What we can confirm

The hard facts here are the package names, the date, and the classification. Our incident catalog recorded these entries on July 28, 2026, each flagged as containing malicious code at critical severity. The @antv entries cover @antv/stat, @antv/xflow-core, @antv/l7-extension-g-layer, @antv/webgpu-graph, @antv/gi-theme-antd, @antv/github-config-cli, @antv/gi-assets-galaxybase, and @antv/gi-assets-tugraph-analytics.

At the time of writing, a detailed public teardown of the payload for this specific wave was not yet available. We are not going to invent file hashes, version strings, or download counts we cannot verify. What we can do is map the affected names precisely and explain how to react, which is the part that matters if your CI runs npm install on a schedule.

Which packages are affected

The compromise spans several unrelated projects, which is the usual signature of a broad account or token abuse campaign rather than a single-project incident. The affected names recorded on July 28, 2026 are:

AntV data-visualization scope (@antv):

@antv/stat
@antv/xflow-core
@antv/l7-extension-g-layer
@antv/webgpu-graph
@antv/gi-theme-antd
@antv/github-config-cli
@antv/gi-assets-galaxybase
@antv/gi-assets-tugraph-analytics

Vaultflow scope (@vaultflow):

Other npm packages:

PyPI:

cfgzen, flagged the same day

Two of these names stand out. paysafe-gbp-virtual-assistant-lib-fe and @design-system-coopeuch/web read like organization-internal package names rather than public libraries. That pattern is consistent with either dependency confusion (someone publishing a public package that shadows a private internal name) or targeting of specific companies. We cannot say which without the registry metadata, so treat that as an observation, not a conclusion. Several other names are classic impersonation shapes: chalk-utils and chalk-pack echo the ubiquitous chalk package, exxpress-tool echoes express, and rimraf-utils echoes rimraf.

Why a compromised @antv scope matters

The scattered typosquats are low blast radius. Someone has to fat-finger an install to get hit. The @antv entries are different because they carry a trusted brand and real transitive reach.

AntV is Ant Group's open-source data-visualization family. It publishes charting and graph libraries such as G2, G6, S2, L7, and X6, plus the GraphInsight ("GI") analytics assets that the @antv/gi-assets-* names belong to. These packages are pulled in by front-end dashboards, geospatial tools, and graph-analytics UIs across a lot of Chinese and international codebases. When a package in a scope like that ships malicious code, it does not only affect teams that typed npm install @antv/stat. It can land through a chart component, a design system, or a plugin that lists one of these as a dependency, which is exactly how supply chain payloads reach machines that never asked for them.

Where this fits in the 2026 npm campaigns

We do not yet have confirmed attribution for the July 28 wave, so anything about the operator is speculation. What we can point to is the pattern the industry has been tracking all year.

According to Palo Alto Networks Unit 42, the npm ecosystem shifted in September 2025 with the self-replicating Shai-Hulud worm, which automated the compromise and redistribution of malicious packages. Unit 42 then documented a run of follow-on campaigns through 2026: a wave calling itself "Shai-Hulud: The Third Coming" starting April 22, a "Mini Shai-Hulud" campaign starting April 29 and continuing into May (which Unit 42 attributes to a cluster it labels TeamPCP), a June 1 compromise of at least 32 packages in the @redhat-cloud-services scope carrying a payload named Miasma, and a July 14 compromise of AsyncAPI release pipelines that pushed five trojanized packages under a campaign named "miasma-train-p1." CISA issued its own alert on the original Shai-Hulud worm in September 2025.

The recurring goal across these families is credential theft. The payloads harvest npm and GitHub tokens, cloud credentials, and CI/CD secrets from whatever machine runs the install, and in the worm variants they use any stolen npm publish rights to push themselves into more packages. That is the behavior to assume for the July 28 packages until a specific analysis says otherwise. Even if this turns out to be a simpler batch of malicious uploads, the response is the same.

How to check whether you are affected

Start by asking whether any affected name resolved into your tree. Run this from a project root:

npm ls @antv/stat @antv/xflow-core @antv/l7-extension-g-layer @antv/webgpu-graph \
  @antv/gi-theme-antd @antv/github-config-cli @antv/gi-assets-galaxybase \
  @antv/gi-assets-tugraph-analytics

Then grep every lockfile in a repo or monorepo for the full set of names, including the non-AntV packages:

grep -rniE "@antv/(stat|xflow-core|l7-extension-g-layer|webgpu-graph|gi-theme-antd|github-config-cli|gi-assets-galaxybase|gi-assets-tugraph-analytics)|@vaultflow/|@design-system-coopeuch/web|chalk-utils|chalk-pack|web3-core-js|truffle-helper|rimraf-utils|joi-pack|exxpress-tool|cdp-core|mcp-echarts|motion-forge-css|bui-react-10components|request-logger-canary|paysafe-gbp-virtual-assistant-lib-fe" \
  package-lock.json yarn.lock pnpm-lock.yaml

For the PyPI side, check for cfgzen:

pip freeze | grep -i cfgzen

If any of these appear, look at when your last install ran. A lockfile that was regenerated or a CI job that ran npm install on or after July 28, 2026, is the risk window. A build that only ever restored from a lockfile pinned before that date, with no fresh resolution, is much less likely to have pulled a poisoned version.

How to remediate

If you find a hit, treat the machine that ran the install as untrusted and work outward from there.

Remove the package or pin a known-good version, then rebuild from a clean state:

rm -rf node_modules
npm cache clean --force
npm ci

Rotate every credential that was reachable from the affected environment. That means npm tokens, GitHub personal access tokens and Actions secrets, cloud provider keys, and any .npmrc or .env values a build step could read. Assume exposure rather than proving it after the fact.

npm token revoke <tokenId>

Block install-time script execution for untrusted installs so a postinstall hook cannot run:

npm install --ignore-scripts

Add a cooldown so freshly published versions cannot reach your builds immediately. Recent npm releases support a minimum release age setting, which buys time for malicious versions to be caught and pulled before you fetch them:

npm config set minimumReleaseAge 1440

Audit CI logs for outbound connections during the install window, and check for any unexpected npm publish events tied to your tokens. Unauthorized publishes are the signature of the worm variants.

If you maintain AntV or any of the other affected packages, revoke and reissue publish tokens, review the account activity around July 28, and enable two-factor authentication and provenance on republished versions.

FAQ

Is @antv safe to use now?

The @antv project as a whole is a long-standing, legitimate library family. The problem is scoped to the specific versions flagged as malicious on July 28, 2026 across the eight packages listed above. Pin to a version published before the incident, or wait for maintainers to confirm clean releases, and apply a release-age cooldown so you are not the first to pull a new version.

How do I know if I installed a compromised @antv package?

Run the npm ls and lockfile grep commands in the checking section against every repo and CI pipeline. The deciding factor is whether a fresh dependency resolution ran on or after July 28, 2026. If your builds only restored from an older pinned lockfile, exposure is unlikely, but still rotate credentials if you cannot rule it out.

What should I do if my CI ran npm install on July 28?

Assume the runner and its secrets are exposed. Rotate npm, GitHub, and cloud credentials, invalidate CI secrets, rebuild runners from a clean image, and review logs for unauthorized npm publish calls or unexpected outbound traffic during the install.

Which packages were compromised?

Eight @antv packages, two @vaultflow packages, and a set of other npm packages including chalk-utils, chalk-pack, web3-core-js, truffle-helper, rimraf-utils, joi-pack, exxpress-tool, cdp-core, mcp-echarts, motion-forge-css, bui-react-10components, request-logger-canary, paysafe-gbp-virtual-assistant-lib-fe, and @design-system-coopeuch/web, plus the PyPI package cfgzen. The full list with catalog links is in the affected-packages section above.