Use of software with malware In @antv/g-plugin-matterjs
Part of a campaign: Mini Shai-Hulud · Discovered Apr 29, 2026
This advisory is one of 515 advisories grouped under a coordinated supply chain attack.
Description
The package @antv/g-plugin-matterjs was found to contain malicious code.
This package was compromised as part of the ongoing "Mini Shai-Hulud is back" worm by the TeamPCP threat actor.
The package will steal credentials and then propogate it to every package it has access to. The package also attempts to remain persistent.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version |
|---|---|---|
 npm |
Aliases
1. 2.
References
1. 2.