Compromised Vant npm token distributes cryptomining malware

Vant maintainers reported that a team member's token had been stolen and used to inject malicious scripts into multiple npm releases on December 19, 2024. The malicious releases were distributed through the legitimate npm channel and contained code designed to deploy XMRig cryptomining malware when installed. Maintainers deprecated the malicious releases within roughly eighty minutes and subsequently released a clean version, making this a confirmed software-supply-chain compromise rather than a vulnerability in Vant itself.