npm package report

Is @antv/g2 safe?

Versions 5.5.8 and 5.6.8 of @antv/g2 were compromised (maintainer token compromise). Other versions are not flagged as malicious.

Do not install @antv/g2 5.5.8 or 5.6.8

CRITICALanalyst verified

Maintainer token compromise, part of the mini_shai_hulud_antv_2026_05_19 campaign. Added to CyberXYZ 2026-05-19, verified by a CyberXYZ analyst.

// what we observed

Mini-Shai-Hulud AntV maintainer-token compromise, 2026-05-19. Socket Threat Research extended package list.

// versions and what to do

Malicious: 5.5.8, 5.6.8
Move to: 5.4.8 newest 5.x release, no known advisory

If one of these versions was installed, remove it and treat the credentials, tokens and SSH keys on that machine as exposed: rotate them. Check CI runners and container images that installed it too.

npm install @antv/g2@5.4.8

// our research

Mini Shai Hulud Returns: AntV npm Ecosystem Attack

// reach

0 direct dependencies

none carry a known advisory

5 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

Checked 2026-10-31 at 00:02 UTC. Updated continuously from NVD, GHSA, OSV and CNA feeds.