// publisher campaign · npm

openwayne

All caught packages published by the openwayne account on npm, plus the author + maintainer info the registry currently exposes. Use this view to pivot: shared emails / names across packages are strong evidence of a single attacker behind multiple throwaway handles.

npmjs.com publisher

packages

distinct names

catch events

versions × names

blast

149/wk

combined weekly downloads

active span

2026-05-19 → 2026-05-19

first → last catch

// publisher osint

Account-level signals. Activity span tells you how long this handle has been around (fresh = throwaway-prone). Email domains separate single-use webmail from real org addresses. Cross-ecosystem handles + GitHub links are the strongest attribution pivot — same name on multiple registries usually means same operator.

activity on npm

packages on registry: 8
first publish: 2018-07-12
latest publish: 2024-12-24
active span: 2357d

same handle on other registries

npm /~openwayne: exists ↗
pypi /user/openwayne: exists ↗
github.com/openwayne: exists ↗

email domains

qq.com×77webmail
gmail.com×56webmail
163.com×22webmail
outlook.com×11webmail
antgroup.com×11

// exfil path

what is read → where it ships

steals

● Apple/CloudKit

sends to

(no destination string extracted — payload may be dynamic / obfuscated)

// cross-publisher email signals

An email from this campaign also appears on caught packages under a different publisher account. Strong evidence that one operator runs both handles.

yunji.me@outlook.com
also on 5 packages from 1 other publisher:
- by
- by
- by
- by
- by
943720372@qq.com
also on 5 packages from 1 other publisher:
- by
- by
- by
- by
- by
jinke.li666@gmail.com
also on 5 packages from 1 other publisher:
- by
- by
- by
- by
- by
120635640@qq.com
also on 5 packages from 1 other publisher:

// shared author identifiers

Same email or author name on more than one package — direct attribution evidence beyond the shared publisher account.

emails

yunji.me@outlook.com— @antv/g6-mobile, @antv/g6-wx, @antv/g6-alipay, @antv/f6, @antv/f6-wx, @antv/f6-ui, @antv/f6-plugin, @antv/f6-hammerjs, @antv/f6-element, @antv/f6-core, @antv/f6-alipay
943720372@qq.com— @antv/g6-mobile, @antv/g6-wx, @antv/g6-alipay, @antv/f6, @antv/f6-wx, @antv/f6-ui, @antv/f6-plugin, @antv/f6-hammerjs, @antv/f6-element, @antv/f6-core, @antv/f6-alipay
jinke.li666@gmail.com— @antv/g6-mobile, @antv/g6-wx, @antv/g6-alipay, @antv/f6, @antv/f6-wx, @antv/f6-ui, @antv/f6-plugin, @antv/f6-hammerjs, @antv/f6-element, @antv/f6-core, @antv/f6-alipay
120635640@qq.com— @antv/g6-mobile, @antv/g6-wx, @antv/g6-alipay, @antv/f6, @antv/f6-wx, @antv/f6-ui, @antv/f6-plugin, @antv/f6-hammerjs, @antv/f6-element, @antv/f6-core, @antv/f6-alipay
army8735@qq.com— @antv/g6-mobile, @antv/g6-wx, @antv/g6-alipay, @antv/f6, @antv/f6-wx, @antv/f6-ui, @antv/f6-plugin, @antv/f6-hammerjs, @antv/f6-element, @antv/f6-core, @antv/f6-alipay
dengfuping_private@163.com— @antv/g6-mobile, @antv/g6-wx, @antv/g6-alipay, @antv/f6, @antv/f6-wx, @antv/f6-ui, @antv/f6-plugin, @antv/f6-hammerjs, @antv/f6-element, @antv/f6-core, @antv/f6-alipay
afc163@gmail.com— @antv/g6-mobile, @antv/g6-wx, @antv/g6-alipay, @antv/f6, @antv/f6-wx, @antv/f6-ui, @antv/f6-plugin, @antv/f6-hammerjs, @antv/f6-element, @antv/f6-core, @antv/f6-alipay
chenluuli@gmail.com

// pattern footprint

Static-analysis flags that fired across the campaign, with how many packages each touched. Use as the "what kind of stealer is this" answer.

// full activity on npm

Every package this account currently has on the registry, newest first. ● caught by our pipeline · ○ not yet flagged.0/8 caught.

@ant-credit/atome-web-sdk@ 4.0.2
atome 组件 sdk
2024-12-24
@ant-credit/atome-server-nodejs-sdk@ 1.0.0
atome nodejs sdk
2022-11-03
@ant-credit/bean-sdk@ 1.3.0-rc.0
bean 组件 sdk
2022-07-08
g6-hammerjs

// packages in this campaign

11 distinct · newest first

↳ author:maintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com>↗ registry
↳ author:https://github.com/orgs/antvis/peoplemaintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com>↗ registry
↳ author:maintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com>↗ registry

openwayne

// publisher osint

// exfil path

// cross-publisher email signals

// shared author identifiers

// pattern footprint

// full activity on npm

// packages in this campaign

@antv/f6-wx@0.0.7

@antv/f6-ui@1.0.3

@antv/f6-plugin@1.0.6

@antv/f6-hammerjs@0.0.2

@antv/f6-element@0.0.1

@antv/f6-core@0.0.2

@antv/f6-alipay@0.0.7

@antv/g6-wx@0.0.1

@antv/g6-mobile@0.1.2

@antv/g6-alipay@0.0.1

@antv/f6@0.0.19