// publisher campaign · npm

neoddish

All caught packages published by the neoddish account on npm, plus the author + maintainer info the registry currently exposes. Use this view to pivot: shared emails / names across packages are strong evidence of a single attacker behind multiple throwaway handles.

npmjs.com publisher

packages

distinct names

catch events

versions × names

blast

239/wk

combined weekly downloads

active span

2026-05-19 → 2026-05-19

first → last catch

// publisher osint

Account-level signals. Activity span tells you how long this handle has been around (fresh = throwaway-prone). Email domains separate single-use webmail from real org addresses. Cross-ecosystem handles + GitHub links are the strongest attribution pivot — same name on multiple registries usually means same operator.

activity on npm

packages on registry: 7
first publish: 2019-12-17
latest publish: 2023-03-20
active span: 1189d

same handle on other registries

npm /~neoddish: exists ↗
pypi /user/neoddish: exists ↗
github.com/neoddish: exists ↗

email domains

qq.com×49webmail
gmail.com×35webmail
163.com×14webmail
outlook.com×7webmail
antgroup.com×7

// cross-publisher email signals

An email from this campaign also appears on caught packages under a different publisher account. Strong evidence that one operator runs both handles.

yunji.me@outlook.com
also on 5 packages from 1 other publisher:
- by
- by
- by
- by
- by
943720372@qq.com
also on 5 packages from 1 other publisher:
- by
- by
- by
- by
- by
jinke.li666@gmail.com
also on 5 packages from 1 other publisher:
- by
- by
- by
- by
- by
120635640@qq.com
also on 5 packages from 1 other publisher:

// shared author identifiers

Same email or author name on more than one package — direct attribution evidence beyond the shared publisher account.

emails

yunji.me@outlook.com— @antv/data-samples, @antv/thumbnails-component, @antv/ckb, @antv/color-schema, @antv/data-wizard, @antv/thumbnails, @antv/lite-insight
943720372@qq.com— @antv/data-samples, @antv/thumbnails-component, @antv/ckb, @antv/color-schema, @antv/data-wizard, @antv/thumbnails, @antv/lite-insight
jinke.li666@gmail.com— @antv/data-samples, @antv/thumbnails-component, @antv/ckb, @antv/color-schema, @antv/data-wizard, @antv/thumbnails, @antv/lite-insight
120635640@qq.com— @antv/data-samples, @antv/thumbnails-component, @antv/ckb, @antv/color-schema, @antv/data-wizard, @antv/thumbnails, @antv/lite-insight
army8735@qq.com— @antv/data-samples, @antv/thumbnails-component, @antv/ckb, @antv/color-schema, @antv/data-wizard, @antv/thumbnails, @antv/lite-insight
dengfuping_private@163.com— @antv/data-samples, @antv/thumbnails-component, @antv/ckb, @antv/color-schema, @antv/data-wizard, @antv/thumbnails, @antv/lite-insight
afc163@gmail.com— @antv/data-samples, @antv/thumbnails-component, @antv/ckb, @antv/color-schema, @antv/data-wizard, @antv/thumbnails, @antv/lite-insight
chenluuli@gmail.com— @antv/data-samples, @antv/thumbnails-component, @antv/ckb, @antv/color-schema, @antv/data-wizard, @antv/thumbnails, @antv/lite-insight

// pattern footprint

Static-analysis flags that fired across the campaign, with how many packages each touched. Use as the "what kind of stealer is this" answer.

// full activity on npm

Every package this account currently has on the registry, newest first. ● caught by our pipeline · ○ not yet flagged.0/7 caught.

antv-site-demo-rc@ 1.1.0
Encapsulation for components of demos in AntV site.
2023-03-20
rfm-cli@ 0.1.0-alpha.5
rfm(Rim Forming Machine) - CLI Scaffold for quick project kickoff.
2022-05-13
color-schema@ 0.2.0
JSON Schema for Color Palette
2021-07-14
color-schema-test

// packages in this campaign

7 distinct · newest first

↳ author:AntVmaintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com>↗ registry
↳ author:AntVmaintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com>↗ registry
↳ author:AntVmaintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com>↗ registry

neoddish

// publisher osint

// cross-publisher email signals

// shared author identifiers

// pattern footprint

// full activity on npm

// packages in this campaign

@antv/data-wizard@2.0.4

@antv/data-samples@1.0.1

@antv/color-schema@0.2.3

@antv/ckb@2.0.4

@antv/thumbnails@2.0.0

@antv/thumbnails-component@2.0.0

@antv/lite-insight@2.1.1