timeago-react
timeago-react is identified in the SafeDep analysis "Mini Shai-Hulud Strikes Again: 317 npm Packages Compromised". A compromised npm maintainer account published 637 malicious versions across 317 packages including size-sensor, echarts-for-react, timeago.js, and hundreds of @antv scoped packages, affecting 15M+ monthly downloads.
discovered 2026-05-19
Threat types
other
Malicious versions
- 3.1.7
- 3.2.7
Campaigns
Indicators
- domaint.m-kosche.comcommunicates-with
- ipv4169.254.169.254communicates-with
- ipv4169.254.170.2communicates-with
- sha256a68dd1e6a6e35ec3771e1f94fe796f55dfe65a2b94560516ff4ac189390dfa1cindicates
- sha11916faa365f2788b6e193514872d51a242876569indicates
- sha17cb42f57561c321ecb09b4552802ae0ac55b3a7aindicates
- sha1dc3d62a2181beb9f326952a2d212900c94f2e13dindicates
- sha1de0fac2e4500dabe0009e67214ff5f5447ce83ddindicates
- sha1bbbca2ddaa5d8feaa63e36b76fdaad77386f024findicates
- email[email protected]exfiltrates-to
- email[email protected]exfiltrates-to
