Popular @antv npm packages have been compromised with malware that steals CI/CD secrets from developers' systems. The 'Mini Shai-Hulud' payload executes during npm install and exfiltrates credentials for GitHub, AWS, Kubernetes, Vault, npm, and 1Password from Linux automation environments.