Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account

Multiple Snyk reports describe the "Mini Shai‑Hulud" supply‑chain worm that leveraged compromised maintainer accounts to publish hundreds of malicious npm package versions across ecosystems (AntV, TanStack, node-ipc and others) and a related malicious PyPI lightning release containing a Bun‑based credential stealer. The campaign chains GitHub Actions "Pwn Request" attacks with cache poisoning and OIDC token extraction from runner memory, even producing packages with valid SLSA Build Level 3 attestations; payloads steal credentials and propagate across packages. Organizations using affected or依