Mini Shai Hulud: Compromised @antv npm packages enable CI/CD credential theft

Microsoft reports a supply‑chain compromise of several @antv npm packages that deploy the “Mini Shai‑Hulud” payload during npm install on Linux CI/CD runners. The malware harvests and exfiltrates CI/CD secrets and tokens from automation environments, targeting GitHub, AWS, Kubernetes, HashiCorp Vault, npm, 1Password and other credential stores, enabling further cloud and pipeline takeover. Attack vector is malicious/compromised npm packages executing at install time; mitigation focuses on protecting CI runners, secret hygiene, and supply‑chain controls.