Active npm supply chain attack compromises hundreds of packages tied to the @antv ecosystem in a large-scale malicious publish wave linked to the ongoing Mini Shai-Hulud campaign. The attack impacts widely used visualization and React-related packages, including @antv/g2, @antv/g6, @antv/x6, @antv/l7, and echarts-for-react, creating significant downstream exposure for organizations automatically consuming new dependency versions.