Compromised AntV packages expose build-system credentials

Microsoft reported on 20 May that an attacker compromised an AntV maintainer account and published malicious versions of data-visualisation packages. The affected dependency chain reached other libraries, widening possible exposure beyond developers who deliberately selected AntV directly.

The described payload ran during npm installation and targeted secrets in development and CI/CD environments. Researchers also reported efforts to evade inspection and forge software-provenance information. A trusted package name or an indirect dependency therefore did not remove the need to identify the installed version and execution window. Microsoft noted the maintainer’s statement that the account situation had been resolved; organisations still needed to assess credentials exposed while malicious versions were present.