Compromised atool npm Account Delivers CI/CD Credential Stealer Across 24 Packages (echarts-for-react package, timeago.js)

The npm account atool (email i@hust.cc, associated with hustcc on GitHub — author of timeago.js and a maintainer of the AntV visualization ecosystem) was compromised. The attacker published two waves of malicious releases across 24 packages in a 10-minute window on 2026-05-19.

Sai Likhith

May 19, 2026

Background: The atool npm Account and Affected Ecosystems

The npm account atool (email i@hust.cc) is the primary publisher of timeago.js, a JavaScript library for relative time formatting (e.g., "3 hours ago") with over 1.5 million weekly downloads. The same account is a member of the AntV maintainer team — Alibaba's open-source data visualization ecosystem that powers graph visualization (@antv/g6), 2D rendering (@antv/g), charting (@antv/g2, @antv/g2plot), map visualization (@antv/l7), and spreadsheet rendering (@antv/s2). Individual AntV packages receive between 50,000 and 2,000,000 weekly downloads.

Environments that install these packages include data engineering pipelines, financial dashboards, React/Vue/Angular front-end builds, and enterprise data platforms. Many of these run inside GitHub Actions, GitLab CI, or Kubernetes-hosted CI/CD pipelines that hold elevated cloud credentials — making this an extremely high-value target for a supply chain attacker.

Compromised Pakcages

Package	Compromised Versions
`timeago.js`	4.1.2, 4.2.2
`timeago-react`	3.1.7, 3.2.7
`echarts-for-react`	3.0.7, 3.1.7, 3.2.7
`jest-canvas-mock`	2.5.3, 2.6.3, 2.7.3
`jest-date-mock`	1.0.11, 1.1.11, 1.2.11
`size-sensor`	1.0.4, 1.1.4, 1.2.4
`canvas-nest.js`	2.1.4, 2.2.4
`filesize.js`	2.1.0, 2.2.0
`onfire.js`	2.1.1, 2.2.1
`relationship.js`	1.3.9, 1.4.9
`ribbon.js`	1.1.2
`slice.js`	1.2.1, 1.3.1
`word-width`	1.1.1, 1.2.1
`lint-md`	0.3.0, 0.4.0
`lint-md-cli`	0.2.2, 0.3.2
`mcp-echarts`	0.8.1, 0.9.1
`mcp-mermaid`	0.5.1, 0.6.1
`@antv/adjust`	0.3.5, 0.4.5
`@antv/algorithm`	0.2.26, 0.3.26
`@antv/async-hook`	2.3.9, 2.4.9
`@antv/attr`	0.4.5, 0.5.5
`@antv/ava`	3.5.1, 3.6.1
`@antv/ava-react`	3.4.2, 3.5.2
`@antv/color-util`	2.1.6, 2.2.6
`@antv/component`	2.2.11, 2.3.11
`@antv/coord`	0.5.7, 0.6.7
`@antv/data-set`	0.12.8, 0.13.8
`@antv/dom-util`	2.1.4, 2.2.4
`@antv/event-emitter`	0.2.3, 0.3.3
`@antv/expr`	1.1.2, 1.2.2
`@antv/f-engine`	1.11.0, 1.12.0
`@antv/f-lottie`	1.11.0, 1.12.0
`@antv/f-my`	1.11.0, 1.12.0
`@antv/f-react`	1.11.0, 1.12.0
`@antv/f-test-utils`	1.1.9, 1.2.9
`@antv/f-vue`	1.11.0, 1.12.0
`@antv/f-wx`	1.11.0, 1.12.0
`@antv/f2`	5.15.0, 5.16.0
`@antv/f2-react`	5.15.0, 5.16.0
`@antv/g`	6.4.1, 6.5.1
`@antv/g-base`	0.6.16, 0.7.16
`@antv/g-camera-api`	2.1.45, 2.2.45
`@antv/g-canvas`	2.3.0, 2.4.0
`@antv/g-device-api`	1.7.13, 1.8.13
`@antv/g-dom-mutation-observer-api`	2.1.42, 2.2.42
`@antv/g-gesture`	3.1.42, 3.2.42
`@antv/g-lite`	2.8.0, 2.9.0
`@antv/g-lottie-player`	1.2.1, 1.3.1
`@antv/g-math`	3.2.0, 3.3.0
`@antv/g-mobile-canvas`	1.2.1, 1.3.1
`@antv/g-mobile-canvas-element`	1.1.42, 1.2.42
`@antv/g-mobile-svg`	1.2.1, 1.3.1
`@antv/g-mobile-webgl`	1.2.1, 1.3.1
`@antv/g-plugin-3d`	2.2.1, 2.3.1
`@antv/g-plugin-a11y`	1.5.1, 1.6.1
`@antv/g-plugin-canvas-path-generator`	2.2.26, 2.3.26
`@antv/g-plugin-canvas-picker`	2.4.1, 2.5.1
`@antv/g-plugin-canvas-renderer`	2.6.1, 2.7.1
`@antv/g-plugin-control`	2.2.1, 2.3.1
`@antv/g-plugin-device-renderer`	2.7.1, 2.8.1
`@antv/g-plugin-dom-interaction`	2.2.31, 2.3.31
`@antv/g-plugin-dragndrop`	2.2.1, 2.3.1
`@antv/g-plugin-html-renderer`	2.4.1, 2.5.1
`@antv/g-plugin-image-loader`	2.4.1, 2.5.1
`@antv/g-plugin-mobile-interaction`	1.1.42, 1.2.42
`@antv/g-plugin-rough-canvas-renderer`	2.2.1, 2.3.1
`@antv/g-plugin-rough-svg-renderer`	2.2.1, 2.3.1
`@antv/g-plugin-svg-picker`	2.1.46, 2.2.46
`@antv/g-plugin-svg-renderer`	2.5.1, 2.6.1
`@antv/g-svg`	2.2.1, 2.3.1
`@antv/g-web-animations-api`	2.2.32, 2.3.32
`@antv/g-webgl`	2.2.1, 2.3.1
`@antv/g-webgpu`	2.2.1, 2.3.1
`@antv/g-webgpu-core`	0.8.2, 0.9.2
`@antv/g-webgpu-engine`	0.8.2, 0.9.2
`@antv/g2`	5.5.8, 5.6.8
`@antv/g2-extension-3d`	0.3.0, 0.4.0
`@antv/g2-extension-ava`	0.3.0, 0.4.0
`@antv/g2-extension-plot`	0.3.2, 0.4.2
`@antv/g2-plugin-slider`	2.2.1, 2.3.1
`@antv/g2plot`	2.5.35, 2.6.35
`@antv/g6`	5.2.1, 5.3.1
`@antv/g6-core`	0.9.24, 0.10.24
`@antv/g6-element`	0.9.25, 0.10.25
`@antv/g6-extension-react`	0.3.7, 0.4.7
`@antv/g6-pc`	0.9.25, 0.10.25
`@antv/g6-plugin`	0.9.25, 0.10.25
`@antv/g6-ssr`	0.2.1, 0.3.1
`@antv/geo-coord`	1.1.8, 1.2.8
`@antv/gi-assets-basic`	2.5.40, 2.6.40
`@antv/gi-sdk`	3.1.0, 3.2.0
`@antv/gi-theme-antd`	0.7.11, 0.8.11
`@antv/gl-matrix`	2.8.1, 2.9.1
`@antv/gpt-vis`	1.1.0, 1.2.0
`@antv/gpt-vis-ssr`	0.4.7, 0.5.7
`@antv/graphin`	3.1.5, 3.2.5
`@antv/graphlib`	2.1.4, 2.2.4
`@antv/hierarchy`	0.8.1, 0.9.1
`@antv/infographic`	0.3.19, 0.4.19
`@antv/l7`	2.26.10, 2.27.10
`@antv/l7-component`	2.26.10, 2.27.10
`@antv/l7-core`	2.26.10, 2.27.10
`@antv/l7-draw`	3.2.5, 3.3.5
`@antv/l7-layers`	2.26.10, 2.27.10
`@antv/l7-map`	2.26.10, 2.27.10
`@antv/l7-maps`	2.26.10, 2.27.10
`@antv/l7-react`	2.5.3, 2.6.3
`@antv/l7-renderer`	2.26.10, 2.27.10
`@antv/l7-scene`	2.26.10, 2.27.10
`@antv/l7-source`	2.26.10, 2.27.10
`@antv/l7-three`	2.26.10, 2.27.10
`@antv/l7-utils`	2.26.10, 2.27.10
`@antv/l7plot`	0.6.11, 0.7.11
`@antv/l7plot-component`	0.1.11, 0.2.11
`@antv/larkmap`	1.6.1, 1.7.1
`@antv/layout-gpu`	1.2.7, 1.3.7
`@antv/layout-wasm`	1.5.2, 1.6.2
`@antv/li-core-assets`	1.4.7, 1.5.7
`@antv/li-editor`	1.7.1, 1.8.1
`@antv/li-sdk`	1.6.1, 1.7.1
`@antv/matrix-util`	3.1.4, 3.2.4
`@antv/mcp-server-antv`	0.2.8, 0.3.8
`@antv/mcp-server-chart`	0.10.10, 0.11.10
`@antv/path-util`	3.1.1, 3.2.1
`@antv/react-g`	2.2.1, 2.3.1
`@antv/s2`	2.8.1, 2.9.1
`@antv/s2-react`	2.4.1, 2.5.1
`@antv/s2-ssr`	0.2.1, 0.3.1
`@antv/s2-vue`	2.3.0, 2.4.0
`@antv/scale`	0.6.2, 0.7.2
`@antv/smart-color`	0.3.1, 0.4.1
`@antv/thumbnails`	2.1.0, 2.2.0
`@antv/util`	3.4.11, 3.5.11
`@antv/vendor`	1.1.11, 1.2.11
`@antv/x6`	3.2.7, 3.3.7
`@antv/x6-angular-shape`	3.1.1, 3.2.1
`@antv/x6-react-shape`	3.1.1, 3.2.1
`@antv/x6-vue-shape`	3.1.2, 3.2.2
`@antv/x6-vue3-shape`	1.1.0, 1.2.0
`@antv/xflow`	2.2.13, 2.3.13
`@lint-md/cli`	2.1.0, 2.2.0
`@lint-md/core`	2.1.0, 2.2.0
`@lint-md/parser`	0.1.14, 0.2.14

Compromised atool npm Account Delivers CI/CD Credential Stealer Across 24 Packages (echarts-for-react package, timeago.js)

Background: The atool npm Account and Affected Ecosystems

Compromised Pakcages

Explore Related Posts

Compromised atool npm Account Delivers CI/CD Credential Stealer Across 24 Packages (echarts-for-react package, timeago.js)

actions-cool/issues-helper GitHub Action Compromised: All Tags Point to Imposter Commit That Exfiltrates CI/CD Credentials

Nx Console VS Code Extension Compromised