{"type":"bundle","id":"bundle--57b411b8-8e9e-59ce-b3b4-9460159d8ec6","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--729f9f81-81d0-524c-95e9-bf376c191b0c","created":"2026-08-09T11:30:00.000Z","modified":"2026-08-09T11:20:00.000Z","name":"Mini Shai-Hulud @antv npm worm wave","description":"Aikido documented a May 2026 Mini Shai-Hulud wave compromising packages in the @antv ecosystem and other npm projects, stealing credentials and planting persistence in VS Code and Claude Code configuration.","aliases":["Mini Shai-Hulud @antv wave"],"first_seen":"2026-05-19T00:00:00.000Z","last_seen":"2026-05-19T00:00:00.000Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"Aikido: Mini Shai-Hulud @antv wave","url":"https://www.aikido.dev/blog/mini-shai-hulud-antv-npm-supply-chain-attack"}]}]}