Malicious Code Found in Popular Open Source Component Echarts-for-React

PANews posted on X (formerly Twitter) that the open-source component echarts-for-react, which has a weekly download rate of 1.1 million, was recently compromised with malicious code. The incident also affected hundreds of packages under Alibaba's data visualization suite, AntV. The breach occurred after the developer account 'atool' was hacked, allowing attackers to insert obfuscated code into the underlying components. The infected version 3.2.7 was released for only 19 minutes before vulnerability scans flagged it. The malicious code, named 'Mini Shai-Hulud,' caused the supply chain security score to plummet to zero. SlowMist's Chief Information Security Officer, 23pds, shared the post and advised developers to conduct thorough checks.