Last Updated: 2026-05-19T06:10:31Z
What’s Happening
Hundreds of NPM packages have been compromised in yet another TeamPCP attack. The attack vector appears to be a single maintainer, atool.
Actions
Review the list of affected packages and versions and check for presence in your environments. Review GitHub repos for indicators of compromise.
Once again, bun is used as the malware executor. Seek bun installs to non-standard locations and process executions from those locations.
Notes
Antv is a popular AI visualization ecosystem from Alibaba. A lot of downloads are involved in this one—millions per week.