PANews reported on May 20th that crypto KOL @mubeitech issued a warning that an open-source base package being downloaded 1.1 million times per week has been flagged as known malware. Its supply chain security score has plummeted to zero. This is a code worm called "Mini Shai-Hulud," which recently completed a large-scale infection in open-source code repositories.

The list of victims consists entirely of frequently used components. Hundreds of packages in Alibaba's data visualization suite, antv, were injected with malicious code. Commonly used front-end tools such as echarts-for-react and timeago.js were also compromised. echarts-for-react alone saw 1.1 million installations per week. The cause was the compromise of a regular developer account. The account with the username atool was compromised. After taking control, the hacker inserted obfuscated malicious code into these low-level components. Just 19 minutes after the infected version 3.2.7 was released, all vulnerabilities were flagged as malicious in the vulnerability scan.

SlowMist's Chief Information Security Officer, 23pds, forwarded the post and wrote an article reminding developers to pay attention to the investigation.