MCPA-2026-0066
Mini Shai-Hulud campaign compromised popular MCP servers (@antv/mcp-server-antv, mcp-echarts, mcp-mermaid)
The Mini Shai-Hulud supply chain attack compromised the npm account `atool` and published 631 malicious versions across 314 packages in an automated 22-minute burst on 2026-07-27. Three widely used MCP servers were among them: @antv/mcp-server-antv 0.2.8, mcp-echarts 0.8.1, and mcp-mermaid 0.5.1. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun script which harvests credentials (npm tokens, cloud keys, environment secrets) and exfiltrates them via the GitHub API as a covert channel. These are real, legitimate MCP servers commonly launched via `npx` from MCP client configs, so any config that resolved one of the trojaned versions executed the payload on install. npm has since removed the malicious versions; only the exact listed versions are affected, and current releases published by the maintainers are clean.
Affected packages
| Ecosystem | Package | Affected versions |
|---|---|---|
| npm | @antv/mcp-server-antv | >= 0.2.8, <= 0.2.8 |
| npm | mcp-echarts | >= 0.8.1, <= 0.8.1 |
| npm | mcp-mermaid | >= 0.5.1, <= 0.5.1 |
Identifiers
GHSA-p6wc-j7x7-ff3vGHSA-33m7-5xmx-p58pGHSA-2f6m-69ww-37wvMAL-2026-4068MAL-2026-4146MAL-2026-4147CWE-506
References
- advisory https://github.com/advisories/GHSA-p6wc-j7x7-ff3v
- advisory https://github.com/advisories/GHSA-33m7-5xmx-p58p
- advisory https://github.com/advisories/GHSA-2f6m-69ww-37wv
- article https://safedep.io/mini-shai-hulud-strikes-again-314-npm-packages-compromised
- article https://socket.dev/blog/antv-packages-compromised
Timeline
- Published: 2026-07-27