// publisher campaign · npm

kopiluwaky

All caught packages published by the kopiluwaky account on npm, plus the author + maintainer info the registry currently exposes. Use this view to pivot: shared emails / names across packages are strong evidence of a single attacker behind multiple throwaway handles.

npmjs.com publisher

packages

distinct names

catch events

versions × names

blast

200K/wk

combined weekly downloads

active span

2026-05-19 → 2026-05-19

first → last catch

// publisher osint

Account-level signals. Activity span tells you how long this handle has been around (fresh = throwaway-prone). Email domains separate single-use webmail from real org addresses. Cross-ecosystem handles + GitHub links are the strongest attribution pivot — same name on multiple registries usually means same operator.

activity on npm

packages on registry: 250
first publish: 2018-08-21
latest publish: 2026-05-12
active span: 2821d

same handle on other registries

npm /~kopiluwaky: exists ↗
pypi /user/kopiluwaky: exists ↗
github.com/kopiluwaky: not found

email domains

qq.com×28webmail
gmail.com×20webmail
163.com×8webmail
outlook.com×4webmail
antgroup.com×4

// exfil path

what is read → where it ships

steals

○ clipboard

sends to

(no destination string extracted — payload may be dynamic / obfuscated)

// cross-publisher email signals

An email from this campaign also appears on caught packages under a different publisher account. Strong evidence that one operator runs both handles.

yunji.me@outlook.com
also on 5 packages from 1 other publisher:
- by
- by
- by
- by
- by
943720372@qq.com
also on 5 packages from 1 other publisher:
- by
- by
- by
- by
- by
jinke.li666@gmail.com
also on 5 packages from 1 other publisher:
- by
- by
- by
- by
- by
120635640@qq.com
also on 5 packages from 1 other publisher:

// shared author identifiers

Same email or author name on more than one package — direct attribution evidence beyond the shared publisher account.

emails

yunji.me@outlook.com— @antv/algorithm, @antv/matrix-util, @antv/g6-plugin-map-view, @antv/gi-assets-xlab
943720372@qq.com— @antv/algorithm, @antv/matrix-util, @antv/g6-plugin-map-view, @antv/gi-assets-xlab
jinke.li666@gmail.com— @antv/algorithm, @antv/matrix-util, @antv/g6-plugin-map-view, @antv/gi-assets-xlab
120635640@qq.com— @antv/algorithm, @antv/matrix-util, @antv/g6-plugin-map-view, @antv/gi-assets-xlab
army8735@qq.com— @antv/algorithm, @antv/matrix-util, @antv/g6-plugin-map-view, @antv/gi-assets-xlab
dengfuping_private@163.com— @antv/algorithm, @antv/matrix-util, @antv/g6-plugin-map-view, @antv/gi-assets-xlab
afc163@gmail.com— @antv/algorithm, @antv/matrix-util, @antv/g6-plugin-map-view, @antv/gi-assets-xlab
chenluuli@gmail.com— @antv/algorithm, @antv/matrix-util, @antv/g6-plugin-map-view, @antv/gi-assets-xlab
1175863618@qq.com— @antv/algorithm, @antv/matrix-util, @antv/g6-plugin-map-view, @antv/gi-assets-xlab
1491812683@qq.com— @antv/algorithm, @antv/matrix-util, @antv/g6-plugin-map-view, @antv/gi-assets-xlab

// pattern footprint

Static-analysis flags that fired across the campaign, with how many packages each touched. Use as the "what kind of stealer is this" answer.

// full activity on npm

Every package this account currently has on the registry, newest first. ● caught by our pipeline · ○ not yet flagged.0/250 caught (registry reports 8457, showing first 250).

@alifd/chat@ 0.3.67
A configurable component library for chat built on React.
2026-05-12
@alifd/next-docs@ 1.27.34
fusion next doc pages for material center and setting platform
2026-03-31
@alifd/theme-20694@ 2.7.3
Powered By [Fusion.Design](https://fusion.design/)
2026-01-30
@alifd/theme-25369

// packages in this campaign

4 distinct · newest first

↳ author:https://github.com/orgs/antvis/peoplemaintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com>↗ registry
↳ author:maintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com>↗ registry
↳ author:https://github.com/orgs/antvis/peoplemaintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com>↗ registry

kopiluwaky

// publisher osint

// exfil path

// cross-publisher email signals

// shared author identifiers

// pattern footprint

// full activity on npm

// packages in this campaign

@antv/algorithm@0.1.26

@antv/matrix-util@3.1.0-beta.3

@antv/gi-assets-xlab@0.1.30

@antv/g6-plugin-map-view@0.0.4