home / campaigns / npm / pddpd // publisher campaign · npm
pddpd All caught packages published by the pddpd account on npm, plus the author + maintainer info the registry currently exposes. Use this view to pivot: shared emails / names across packages are strong evidence of a single attacker behind multiple throwaway handles.
catch events
6
versions × names
blast
63/wk
combined weekly downloads
active span
2026-05-19 → 2026-05-19
first → last catch
// publisher osint Account-level signals. Activity span tells you how long this handle has been around (fresh = throwaway-prone). Email domains separate single-use webmail from real org addresses. Cross-ecosystem handles + GitHub links are the strongest attribution pivot — same name on multiple registries usually means same operator.
activity on npm
packages on registry: 4 first publish: 2022-04-28latest publish: 2022-04-28active span: 1demail domains
qq.com×42 webmail gmail.com×30 webmail 163.com×12 webmail outlook.com×6 webmail antgroup.com×6
yunji.me@outlook.com
also on 5 packages from 1 other publisher:
943720372@qq.com
also on 5 packages from 1 other publisher:
jinke.li666@gmail.com
also on 5 packages from 1 other publisher:
120635640@qq.com
also on 5 packages from 1 other publisher:
emails
yunji.me@outlook.com — @antv/knowledge, @antv/dw-util, @antv/dw-transform, @antv/dw-random, @antv/dw-analyzer, @antv/chart-linter 943720372@qq.com — @antv/knowledge, @antv/dw-util, @antv/dw-transform, @antv/dw-random, @antv/dw-analyzer, @antv/chart-linter jinke.li666@gmail.com — @antv/knowledge, @antv/dw-util, @antv/dw-transform, @antv/dw-random, @antv/dw-analyzer, @antv/chart-linter 120635640@qq.com — @antv/knowledge, @antv/dw-util, @antv/dw-transform, @antv/dw-random, @antv/dw-analyzer, @antv/chart-linter army8735@qq.com — @antv/knowledge, @antv/dw-util, @antv/dw-transform, @antv/dw-random, @antv/dw-analyzer, @antv/chart-linter dengfuping_private@163.com — @antv/knowledge, @antv/dw-util, @antv/dw-transform, @antv/dw-random, @antv/dw-analyzer, @antv/chart-linter afc163@gmail.com — @antv/knowledge, @antv/dw-util, @antv/dw-transform, @antv/dw-random, @antv/dw-analyzer, @antv/chart-linter chenluuli@gmail.com — @antv/knowledge, @antv/dw-util, @antv/dw-transform, @antv/dw-random, @antv/dw-analyzer, @antv/chart-linter 1175863618@qq.com — @antv/knowledge, @antv/dw-util, @antv/dw-transform, @antv/dw-random, @antv/dw-analyzer, @antv/chart-linter // pattern footprint Static-analysis flags that fired across the campaign, with how many packages each touched. Use as the "what kind of stealer is this" answer.
○ 2022-04-28 ○ Ducky config panel plugin
2022-04-28 ○ 2022-04-28 ○
// packages in this campaign 6 distinct · newest first ↳ author: AFX maintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com> ↗ registry ↳ author: AFX maintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com> ↗ registry ↳ author: AFX maintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com> ↗ registry army8735@qq.com
also on 5 packages from 1 other publisher:
dengfuping_private@163.com
also on 5 packages from 1 other publisher:
afc163@gmail.com
also on 5 packages from 1 other publisher:
chenluuli@gmail.com
also on 5 packages from 1 other publisher:
1175863618@qq.com
also on 5 packages from 1 other publisher:
1491812683@qq.com
also on 5 packages from 1 other publisher:
zhuyuxin0627@gmail.com
also on 5 packages from 1 other publisher:
ojh496845051@gmail.com
also on 5 packages from 1 other publisher:
wzwahl36@qq.com
also on 5 packages from 1 other publisher:
610999886@qq.com
also on 5 packages from 1 other publisher:
alex_zjt@163.com
also on 5 packages from 1 other publisher:
duxinyue.dxy@antgroup.com
also on 5 packages from 1 other publisher:
1491812683@qq.com — @antv/knowledge, @antv/dw-util, @antv/dw-transform, @antv/dw-random, @antv/dw-analyzer, @antv/chart-linter
zhuyuxin0627@gmail.com — @antv/knowledge, @antv/dw-util, @antv/dw-transform, @antv/dw-random, @antv/dw-analyzer, @antv/chart-linter
ojh496845051@gmail.com — @antv/knowledge, @antv/dw-util, @antv/dw-transform, @antv/dw-random, @antv/dw-analyzer, @antv/chart-linter
wzwahl36@qq.com — @antv/knowledge, @antv/dw-util, @antv/dw-transform, @antv/dw-random, @antv/dw-analyzer, @antv/chart-linter
610999886@qq.com — @antv/knowledge, @antv/dw-util, @antv/dw-transform, @antv/dw-random, @antv/dw-analyzer, @antv/chart-linter
alex_zjt@163.com — @antv/knowledge, @antv/dw-util, @antv/dw-transform, @antv/dw-random, @antv/dw-analyzer, @antv/chart-linter
duxinyue.dxy@antgroup.com — @antv/knowledge, @antv/dw-util, @antv/dw-transform, @antv/dw-random, @antv/dw-analyzer, @antv/chart-linter author names
afx — @antv/knowledge, @antv/dw-util, @antv/dw-transform, @antv/dw-random, @antv/dw-analyzer, @antv/chart-linter @ 0.0.1-alpha.0
2022-04-28
/ npm / 2021-06-23 / MAL-2026-3876
@antv/dw-random@1.1.7 by pddpd
→ sends to https://tools.ietf.org/html/rfc3339#section-5.6
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s), 1 other host(s).
↳ author: AFX maintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com> ↗ registry / npm / 2021-05-27 / MAL-2026-3875
@antv/dw-analyzer@1.1.5 by pddpd
数据类型分析
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
↳ author: AFX maintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com> ↗ registry / npm / 2021-06-04 / MAL-2026-3857
@antv/chart-linter@1.1.6 by pddpd
ChartLinter
→ sends to https://unpkg.com/wasm-clingo@0.3.0
child-process-spawn
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
↳ author: AFX maintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com> ↗ registry / npm / 2021-05-19 / MAL-2026-4032
@antv/knowledge@1.1.4 by pddpd
Chart Knowledge Base
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
/ npm / 2021-05-19 / MAL-2026-3878
@antv/dw-util@1.1.4 by pddpd
Util library for DataWizard
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
/ npm / 2021-06-23 / MAL-2026-3877
@antv/dw-transform@1.1.7 by pddpd
## Install
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
