npm package report

Is echarts-for-react safe?

Versions 3.0.7, 3.1.7 and 3.2.7 of echarts-for-react were compromised (maintainer token compromise). Other versions are not flagged as malicious.

Do not install echarts-for-react 3.0.7, 3.1.7 or 3.2.7

CRITICALanalyst verified

Maintainer token compromise, part of the mini_shai_hulud_antv_2026_05_19 campaign. Confirmed 2026-05-19, verified by a CyberXYZ analyst.

// what we observed

Mini-Shai-Hulud: maintainer-token compromise in AntV ecosystem, 2026-05-19 disclosed by Endor Labs. Payload: credential exfil (GitHub/npm/GCP/AWS/Vault tokens) → filev2.getsession[.]org over TCP/443; persistence via .claude/settings.json + .vscode/tasks.json hooks; OIDC token minting + Sigstore provenance forgery.

// versions and what to do

Malicious: 3.0.7, 3.1.7, 3.2.7
Move to: 3.0.6 newest 3.x release, no known advisory

If one of these versions was installed, remove it and treat the credentials, tokens and SSH keys on that machine as exposed: rotate them. Check CI runners and container images that installed it too.

npm install echarts-for-react@3.0.6

// reach

1 direct dependencies

none carry a known advisory

5 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

Checked 2026-10-23 at 18:45 UTC. Updated continuously from NVD, GHSA, OSV and CNA feeds.