home / campaigns / npm / GitHub Actions // publisher campaign · npm
GitHub Actions All caught packages published by the GitHub Actions account on npm, plus the author + maintainer info the registry currently exposes. Use this view to pivot: shared emails / names across packages are strong evidence of a single attacker behind multiple throwaway handles.
catch events
11
versions × names
blast
7.7K/wk
combined weekly downloads
active span
2026-05-19 → 2026-06-05
first → last catch
// publisher osint Account-level signals. Activity span tells you how long this handle has been around (fresh = throwaway-prone). Email domains separate single-use webmail from real org addresses. Cross-ecosystem handles + GitHub links are the strongest attribution pivot — same name on multiple registries usually means same operator.
activity on npm
Not available on this ecosystem (registry search unsupported).
same handle on other registries
npm /~GitHub Actions: not found pypi /user/GitHub Actions: exists ↗ github.com/GitHub Actions: not found email domains
gmail.com×30 webmail qq.com×28 webmail autofleet.io×11 163.com×8 webmail outlook.com×4 webmail antgroup.com×4 sap.com×3 amazon.com×2 jagreehal.com×1 linuxfoundation.org×1 cdkinsights.dev×1 leepriest.dev // exfil path what is read → where it ships steals
○ home dir○ system info○ clipboardsends to
(no destination string extracted — payload may be dynamic / obfuscated)
yunji.me@outlook.com
also on 5 packages from 1 other publisher:
943720372@qq.com
also on 5 packages from 1 other publisher:
jinke.li666@gmail.com
also on 5 packages from 1 other publisher:
120635640@qq.com
also on 5 packages from 1 other publisher:
emails
yunji.me@outlook.com — @antv/s2-vue, @antv/mcp-server-antv, @antv/s2, @antv/dumi-theme-antv 943720372@qq.com — @antv/s2-vue, @antv/mcp-server-antv, @antv/s2, @antv/dumi-theme-antv jinke.li666@gmail.com — @antv/s2-vue, @antv/mcp-server-antv, @antv/s2, @antv/dumi-theme-antv 120635640@qq.com — @antv/s2-vue, @antv/mcp-server-antv, @antv/s2, @antv/dumi-theme-antv army8735@qq.com — @antv/s2-vue, @antv/mcp-server-antv, @antv/s2, @antv/dumi-theme-antv dengfuping_private@163.com — @antv/s2-vue, @antv/mcp-server-antv, @antv/s2, @antv/dumi-theme-antv afc163@gmail.com — @antv/s2-vue, @antv/mcp-server-antv, @antv/s2, @antv/dumi-theme-antv chenluuli@gmail.com — @antv/s2-vue, @antv/mcp-server-antv, @antv/s2, @antv/dumi-theme-antv 1175863618@qq.com — @antv/s2-vue, @antv/mcp-server-antv, @antv/s2, @antv/dumi-theme-antv 1491812683@qq.com — @antv/s2-vue, @antv/mcp-server-antv, @antv/s2, @antv/dumi-theme-antv // pattern footprint Static-analysis flags that fired across the campaign, with how many packages each touched. Use as the "what kind of stealer is this" answer.
// packages in this campaign 11 distinct · newest first ↳ author: Jag Reehal <jag@jagreehal.com> maintainers: jagreehal <jag.reehal@gmail.com> ↗ registry ↳ author: opensearch-project maintainers: opensearch-project-bot <opensearch-infra@amazon.com>, peterzhuamazon <zhujiaxi@amazon.com>, thelinuxfoundation <admin@linuxfoundation.org> ↗ registry ↳ author: Lee Priest <lee@cdkinsights.dev> maintainers: leepriest <lee@leepriest.dev> ↗ registry ↳ author: Tanner Linsley maintainers: tannerlinsley <tannerlinsley@gmail.com>, alemtuzlak <t.zlak97@gmail.com>, kevinvandy <kevinvandy656@gmail.com> ↗ registry ↳ author: Scott Cooper <scttcper@gmail.com> maintainers: scttcper <scttcper@gmail.com> ↗ registry ×1
army8735@qq.com
also on 5 packages from 1 other publisher:
dengfuping_private@163.com
also on 5 packages from 1 other publisher:
afc163@gmail.com
also on 5 packages from 1 other publisher:
chenluuli@gmail.com
also on 5 packages from 1 other publisher:
1175863618@qq.com
also on 5 packages from 1 other publisher:
1491812683@qq.com
also on 5 packages from 1 other publisher:
zhuyuxin0627@gmail.com
also on 5 packages from 1 other publisher:
ojh496845051@gmail.com
also on 5 packages from 1 other publisher:
wzwahl36@qq.com
also on 5 packages from 1 other publisher:
610999886@qq.com
also on 5 packages from 1 other publisher:
alex_zjt@163.com
also on 5 packages from 1 other publisher:
duxinyue.dxy@antgroup.com
also on 5 packages from 1 other publisher:
zhuyuxin0627@gmail.com
— @antv/s2-vue, @antv/mcp-server-antv, @antv/s2, @antv/dumi-theme-antv
ojh496845051@gmail.com — @antv/s2-vue, @antv/mcp-server-antv, @antv/s2, @antv/dumi-theme-antv
wzwahl36@qq.com — @antv/s2-vue, @antv/mcp-server-antv, @antv/s2, @antv/dumi-theme-antv
610999886@qq.com — @antv/s2-vue, @antv/mcp-server-antv, @antv/s2, @antv/dumi-theme-antv
alex_zjt@163.com — @antv/s2-vue, @antv/mcp-server-antv, @antv/s2, @antv/dumi-theme-antv
duxinyue.dxy@antgroup.com — @antv/s2-vue, @antv/mcp-server-antv, @antv/s2, @antv/dumi-theme-antv author names
https://github.com/orgs/antvis/people — @antv/s2-vue, @antv/s2 / npm / 2026-05-26 / MAL-2026-4787
@autofleet/rabbit@5.6.0 by GitHub Actions
The breaking change in this version is the removal of `zehut` from dependencies and usage as a peer-dependency. The required version of zehut is now `^4.0.0`.
→ sends to https://github.com/Autofleet/autorepo.git
public-github-push
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
↳ author: maintainers: omergery <omergery@autofleet.io>, bosmat <bosmat@autofleet.io>, aaronlieblich <lieblichaaron@gmail.com>, nathanaf <nathan@autofleet.io>, dor_shay <dorshay6@gmail.com>, sephi-af <jjnjjn@gmail.com>, roei-autofleet <roei@autofleet.io>, itayankri <itay.ankri@gmail.com>, dsalti12 <dror@autofleet.io>, evanmyara <evank121@gmail.com>, shaktipada <shaktipada@autofleet.io>, oleg.drushits <olegdrushits@autofleet.io>, abir2 <abir@autofleet.io>, matanl2208 <matan@autofleet.io>, ofekrotem <ofekrotem@autofleet.io>, hilatd-autofleet <hilat@autofleet.io> ↗ registry / npm / 2026-05-18 / MAL-2026-4161
@cap-js/openapi@1.4.2 by GitHub Actions
CAP tool for OpenAPI
→ sends to https://github.com/cap-js/openapi.git
public-github-push
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s), 1 other host(s).
↳ author: SAP SE maintainers: sap_extncrepos <mob.extrepo.stores@sap.com>, cap-npm <cap@sap.com>, sap-ospo-admin <ospo@sap.com> ↗ registry / npm / 2026-05-18 / MAL-2026-4077
@antv/s2@2.7.1 by GitHub Actions
effective spreadsheet render core lib
→ sends to https://s2.antv.antgroup.com
public-github-push clipboard-access reads-env-vars
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s), 1 other host(s).
↳ author: https://github.com/orgs/antvis/people maintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com> ↗ registry / npm / 2026-03-31 / MAL-2026-4081
@antv/s2-vue@2.2.0 by GitHub Actions
use S2 with vue
→ sends to https://s2.antv.antgroup.com
public-github-push
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s), 1 other host(s).
↳ author: https://github.com/orgs/antvis/people maintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com> ↗ registry / npm / 2026-04-27 / MAL-2026-4068
@antv/mcp-server-antv@0.1.8 by GitHub Actions
MCP Server for AntV visualization libraries development, which provides documentation context and examples for visualization developers.
→ sends to https://github.com/antvis/mcp-server-antv
install-path-npm-publish reads-env-vars
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
↳ author: AntV maintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com> ↗ registry / npm / 2026-04-16 / MAL-2026-3874
@antv/dumi-theme-antv@0.8.4 by GitHub Actions
AntV website theme based on dumi2.
→ sends to https://github.com/antvis/dumi-theme-antv#readme
→ No suspicious destination, no remote-exec shape — 3 known-vendor host(s), 2 other host(s).
↳ author: maintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com> ↗ registry / npm / 2026-01-15 / MAL-2026-5185
@jagreehal/workflow@1.16.0 by GitHub Actions
Typed async workflows with automatic error inference. Build type-safe workflows with Result types, step caching, resume state, and human-in-the-loop support.
public-github-push
/ npm / 2026-04-27 / MAL-2026-3434
@opensearch-project/opensearch@3.6.0 by GitHub Actions
The official OpenSearch client for Node.js
→ sends to https://www.opensearch.org/
public-github-push reads-env-vars base64-decode reads-homedir reads-system-info
→ No suspicious destination, no remote-exec shape — 3 other host(s).
/ npm / 2026-05-22 / MAL-2026-4508
cdk-insights@1.41.2 by GitHub Actions
AWS CDK security and cost analysis CLI. Free static scans via npm — no account needed. Sign up free to add AI-powered insights.
→ sends to https://s2zhmjbwlj.execute-api.eu-west-2.amazonaws.com/v1
public-github-push install-path-npm-publish
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
/ npm / 2026-05-22 / MAL-2026-3482
@tanstack/solid-router-devtools@2.0.0-beta.14 by GitHub Actions
Modern and scalable routing for Solid applications
→ sends to https://github.com/TanStack/router.git
public-github-push
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
/ npm / 2026-05-18 / MAL-2026-4377
@ctrl/plex@6.0.0 by GitHub Actions
Plex api client in typescript using ofetch
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
0.85
