@antv Had 17 npm Publishers When It Was Compromised. That's the Point.

On May 20, 2026, Microsoft reported that @antv npm packages were compromised in the Mini Shai-Hulud campaign. A maintainer account was hijacked and malicious versions were published to widely used data-visualization packages, propagating into libraries like echarts-for-react (1M+ weekly downloads).

I ran the @antv packages through Commit's behavioral audit. None scored CRITICAL. That surprised me for about ten seconds — then it clicked.

The @antv audit

Package	Score	Publishers	Downloads/wk	Risk
@antv/g6	89	17	228K	—
@antv/g2	87	18	337K	—
@antv/x6	87	17	109K	—
@antv/l7	83	17	45K	—
@antv/s2	80	17	8K	—

Seventeen publishers. Decent Scorecard scores. No CRITICAL flags.

The attack worked because one of those seventeen accounts was compromised. Behavioral signals that measure publisher concentration don't catch this shape of attack — they catch a different one.

Three attacks in two weeks. Three different profiles.

Attack	Date	Publishers	Vector	Behavioral flag?
TanStack	May 11	5	GitHub Actions OIDC token hijack	No — bypassed publisher layer
node-ipc	May 14	1	Sole publisher credential theft	Yes — CRITICAL before attack
@antv	May 20	17	Maintainer account compromise	No — multi-publisher dilutes risk

node-ipc is the archetype of publisher concentration risk: one person, 10M+ downloads per week, one compromised credential away from a malicious publish reaching millions of machines. Commit flagged it CRITICAL months before the attack.

TanStack is a CI/CD pipeline attack. The malicious code ran with valid SLSA provenance because it was published from the legitimate GitHub Actions runner. Publisher count is irrelevant — the attack bypassed the registry entirely.

@antv sits between them. Multiple publishers raise the cost of compromise but don't eliminate it. One compromised account out of seventeen was enough.

No single signal catches everything

This is the uncomfortable truth that tool marketing usually avoids.

• Publisher concentration (what Commit measures) catches node-ipc-shaped attacks. Single point of failure, credential theft, massive blast radius.
• Process security (OpenSSF Scorecard) catches CI/CD pipeline weaknesses. But axios scored 8.0/10 on Scorecard and was still attacked.
• Behavioral analysis (Socket) catches malicious code patterns at install time. But only after the malicious version is published.

Three attacks, three profiles, three different tools. The fantasy of one tool to catch them all is marketing, not security.

What Commit does catch

Right now, these npm packages have one publisher and more than 10M weekly downloads:

Package	Downloads/wk	Publishers
minimatch	562M	1
chalk	413M	1
glob	333M	1
cross-spawn	190M	1
zod	163M	1
lodash	145M	1
axios	109M	1
hono	37M	1

npm audit shows zero vulnerabilities for all of them. When the next credential-theft attack hits npm, behavioral signals will have flagged it. Process scores won't have helped. And when the next CI/CD attack hits, behavioral signals won't help. Scorecard will. Use both.

Check your own stack

npx proof-of-commitment --file package-lock.json

Or scan directly: getcommit.dev/audit.

Open source on GitHub. Pro tier adds batch API, monitoring, and alerts.