Sometime in late May 2026, a poisoned update slipped into the @antv family of JavaScript visualization libraries, the ...