discovered
mcp-echarts is identified in the SafeDep analysis "Mini Shai-Hulud Strikes Again: 317 npm Packages Compromised". A compromised npm maintainer account published 637 malicious versions across 317 packages including size-sensor, echarts-for-react, timeago.js, and hundreds of @antv scoped packages, affecting 15M+ monthly downloads.