npm package report

Is lint-md safe?

Versions 0.3.0 and 0.4.0 of lint-md were compromised (maintainer account compromise). Other versions are not flagged as malicious.

Do not install lint-md 0.3.0 or 0.4.0

CRITICALanalyst verified

Maintainer account compromise, part of the mini_shai_hulud_antv_2026_05_19 campaign. Added to CyberXYZ 2026-05-19, verified by a CyberXYZ analyst.

// what we observed

atool npm account compromise (i@hust.cc / hustcc on GitHub). Same actor compromised AntV namespace. Published two waves of malicious versions across 24 packages; all versions from this account are suspect until token rotation confirmed.

// versions and what to do

Malicious: 0.3.0, 0.4.0
Move to: 0.2.0 newest 0.x release, no known advisory

If one of these versions was installed, remove it and treat the credentials, tokens and SSH keys on that machine as exposed: rotate them. Check CI runners and container images that installed it too.

npm install lint-md@0.2.0

// reach

3 direct dependencies

1 carry known advisories, worst CRITICAL

lodashCRITICAL

1 packages depend on it

an advisory here reaches each of them

lint-md-cli

Create a free accountfor every dependency path, dependent and what to upgrade

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

Checked 2026-10-31 at 00:00 UTC. Updated continuously from NVD, GHSA, OSV and CNA feeds.