Worms in the npm packages again.

Our endless supply chain nightmare continues as the delightfully named Mini Shai-Hulud campaign compromises various npm packages within the @antv ecosystem. This developer tragedy affected anyone foolish enough to trust these poisoned dependencies without checking who actually maintained them first. To protect ourselves from this crawling menace, we must secure compromised maintainer accounts and somehow verify what we are downloading. I suppose expecting developers to audit their packages is far too much to ask, so we will probably just wait for the next inevitably ruined library.