Supply chain · npm · High

Critical Malicious npm Package: @antv/g-plugin-svg-picker Steals Credentials

Threat Engine Auto-Feed · data current as of 2026-07-26

The npm package `@antv/g-plugin-svg-picker` version 2.1.46 contains malicious code designed to steal various credentials and establish persistence. This package is part of the 'Mini Shai-Hulud' supply chain attack campaign, which compromised numerous npm packages through an automated burst. Organizations using this specific version are at critical risk of credential theft and further compromise.

  • Package: npm / @antv/g-plugin-svg-picker
  • Affected versions: = 2.1.46
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Credential / secret theft

The npm package `@antv/g-plugin-svg-picker` version 2.1.46 was compromised as part of the 'Mini Shai-Hulud' supply chain attack. A threat actor gained control of the `atool` npm account and published malicious versions across 314 npm packages. This specific package was modified to include a malicious `preinstall` hook.

How the attack works

The attack leverages a `preinstall` hook to execute an obfuscated Bun script during package installation. This script is designed to exfiltrate sensitive credentials using the GitHub API as a covert channel. The attack also establishes persistence through methods such as injecting GitHub Actions workflows, AI agent session hooks, and a system daemon.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that automatically pull package dependencies
  • Teams that have directly or indirectly installed `@antv/g-plugin-svg-picker` version 2.1.46

Conditions that increase exposure

  • Unpinned dependencies in `package.json` allowing automatic updates to compromised versions
  • Lack of `package-lock.json` or `yarn.lock` to ensure deterministic dependency resolution
  • Use of internal package mirrors that may not filter malicious versions
  • CI/CD environments with broad access to secrets and tokens

Blast-radius scenarios

  • If the package is installed, an attacker can steal AWS keys, GitHub PATs, npm tokens, GCP service accounts, Azure credentials, Kubernetes service account tokens, SSH keys, Docker auth configs, database connection strings, Stripe keys, and Slack tokens.
  • The attacker can establish persistence within the compromised environment through CI/CD workflow injection, AI agent session hooks, and system daemons, leading to further unauthorized access and control.
  • Stolen credentials can be used to access and compromise other internal systems, cloud environments, and developer accounts, expanding the blast radius significantly.

What to do (defensive)

Detect

  • Scan `package-lock.json` or `yarn.lock` files for `@antv/g-plugin-svg-picker` version 2.1.46.
  • Review CI/CD logs for unusual `preinstall` script executions or new GitHub Actions workflows (e.g., `Run Copilot`).
  • Monitor network traffic for suspicious outbound connections to GitHub API endpoints that are not associated with legitimate GitHub operations.
  • Audit system processes for unknown daemons like `kitty-monitor`.

Contain

  • Immediately quarantine any systems or CI/CD environments found to have installed `@antv/g-plugin-svg-picker` version 2.1.46.
  • Block network access for compromised systems to external GitHub API endpoints if not essential for legitimate operations.
  • Revoke and rotate all credentials (AWS keys, GitHub PATs, npm tokens, GCP service accounts, Azure credentials, Kubernetes service account tokens, SSH keys, Docker auth configs, database connection strings, Stripe keys, Slack tokens) that may have been exposed on affected systems.

Remediate

  • Remove `@antv/g-plugin-svg-picker` version 2.1.46 from all projects and ensure no malicious versions are present in dependency trees.
  • Update `package.json` to pin exact, known-good versions of all dependencies to prevent automatic pulls of compromised packages.
  • Implement `package-lock.json` or `yarn.lock` and commit them to version control to ensure deterministic builds.
  • Review and remove any unauthorized GitHub Actions workflows (e.g., `Run Copilot`), AI agent session hooks, or system daemons (e.g., `kitty-monitor`).
  • Conduct a thorough forensic analysis of affected systems to identify the full extent of compromise and any lingering persistence mechanisms.

Frontier verdict — High

This is a critical supply-chain attack requiring immediate action to identify and remediate installations of the malicious npm package `@antv/g-plugin-svg-picker` version 2.1.46 and rotate exposed credentials.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.