Snyk

We are investigating an active supply chain compromise affecting multiple npm packages. Current reporting indicates that malicious package versions were published to the npm registry on June 3-4 using a novel install-time execution path involving binding.gyp / node-gyp. Unlike more common npm supply chain compromises that rely on preinstall or postinstall lifecycle scripts, this activity uses binding.gyp to trigger execution during npm install. In the initial wave, 57 npm packages were affected, with multiple malicious versions across the affected package set. The affected package and version list will be updated if the campaign expands. The malicious behavior reportedly includes credential harvesting from developer and CI/CD environments, GitHub Actions workflow injection, package poisoning, and credential exfiltration. It gains persistence by injection into AI assistant configuration files. Initial Snyk advisories are being published, and the investigation remains ongoing. At this time, there is no confirmed Snyk customer impact. Snyk is not impacted. However, any environment that has installed affected package versions should be considered potentially compromised, and appropriate remediation actions should be taken, including removing compromised packages, rotating credentials from a trusted machine, and reviewing developer workstations and CI/CD systems for unauthorized…

We are investigating an active supply chain compromise affecting multiple widely used packages in the `laravel-lang` namespace in the PHP/Composer ecosystem, distributed via Packagist. Snyk services are not impacted by this incident. At least 700 historical package versions across four packages in the `laravel-lang/*` namespace are currently believed to have been compromised, and malicious versions were published to Packagist between May 22 and May 23, 2026. The affected packages are community-maintained Laravel localization libraries and are not part of the official Laravel framework. Initial analysis suggests the attacker bypassed the official repositories entirely by publishing malicious version tags that point to commits in an attacker-controlled fork. The coordinated republication of tags across multiple repositories in the same GitHub organization indicates the attacker likely obtained access to organization-level release credentials. Packagist has taken down the malicious versions and temporarily unlisted the affected packages while investigation and remediation efforts continue. Initial Snyk advisories have been published, and the investigation remains ongoing. At this time, there is no confirmed Snyk customer impact. However, any environment that has installed affected package versions should be considered potentially compromised, and appropriate remediation actions…

We continue to monitor the AntV / Mini Shai-Hulud supply chain compromise and validate affected packages and versions. Since our last update, Snyk has identified additional related activity involving the PyPI package durabletask. The affected versions are 1.4.1, 1.4.2, and 1.4.3. This activity appears related to the broader Mini Shai-Hulud campaign, with limited propagation compared to the npm impact observed in the AntV ecosystem. Snyk has published an advisory for durabletask and is updating the Zero-Day report and dedicated security.snyk.io page accordingly. Customers can continue to assess potential impact in the Snyk app by visiting: Analytics → Reports → Zero-Day → Active Security Incident Assessment for Antv Supply Chain Compromise - May 2026 Snyk has confirmed there is no indication that Snyk systems, products, or infrastructure were compromised. For additional background and technical details, please refer to the Snyk Blog posts \[AntV , durabletask\]. We will continue to monitor the situation and provide updates as needed.

We continue to investigate the active supply chain compromise affecting multiple packages in the AntV npm ecosystem. The “Active Security Incident Assessment for Antv Supply Chain Compromise - May 2026” report is now available in the Snyk app. Customers can use this report to assess potential impact by visiting: Analytics → Reports → Zero-Day → Active Security Incident Assessment for Antv Supply Chain Compromise - May 2026 Current findings indicate that approximately 323 unique npm packages may have been affected, with more than 639 malicious package versions published to the npm registry. The affected packages include packages within the @antv/\* namespace and related npm packages outside the AntV namespace. Any environment that has installed affected package versions should be considered potentially compromised, and appropriate remediation actions should be taken, including reviewing dependency trees and lockfiles, removing or pinning affected packages to known-good versions, rotating credentials from a trusted environment, and reviewing CI/CD systems for suspicious activity. You can use the dedicated security.snyk.io page to identify affected package versions and review recommended remediation actions. For additional background and technical details, please refer to the Snyk Blog post. The investigation remains ongoing, and the scope may change as additional information…

We are investigating an active supply chain compromise affecting multiple widely used packages in the AntV npm ecosystem. Current reporting associates this activity with the ongoing “Mini Shai-Hulud” supply chain campaign, which is impacting additional npm packages outside the @antv/\* namespace. More than 323 unique npm packages are currently believed to have been affected, with more than 639 malicious package versions published to the npm registry. Initial analysis suggests the attacker compromised an npm maintainer account, enabling the publication of malicious packages across a broad set of packages. Initial Snyk Advisories are being prepared, and the investigation remains ongoing. At this time, we are continuing to assess the potential impact on Snyk customers. However, any environment that has installed affected package versions should be considered potentially compromised, and appropriate remediation actions should be taken, including credential rotation and environment review. We will continue to monitor the situation and update this page as more information becomes available.