Sometime in late May 2026, a poisoned update slipped into the @antv family of JavaScript visualization libraries, the charting toolkit behind countless dashboards and data-heavy front ends. Security ...