A compromised npm maintainer account published 637 malicious versions across 317 packages including size-sensor, echarts-for-react, timeago.js, and hundreds of @antv scoped packages, affecting 15M+... SafeDep Team May 19, 2026
First seen: 2026-05-22 10:17
Last seen: 2026-05-23 11:34