home / campaigns / npm / xuying1027 // publisher campaign · npm
xuying1027 All caught packages published by the xuying1027 account on npm, plus the author + maintainer info the registry currently exposes. Use this view to pivot: shared emails / names across packages are strong evidence of a single attacker behind multiple throwaway handles.
catch events
6
versions × names
blast
76/wk
combined weekly downloads
active span
2026-05-19 → 2026-05-19
first → last catch
// publisher osint Account-level signals. Activity span tells you how long this handle has been around (fresh = throwaway-prone). Email domains separate single-use webmail from real org addresses. Cross-ecosystem handles + GitHub links are the strongest attribution pivot — same name on multiple registries usually means same operator.
activity on npm
Not available on this ecosystem (registry search unsupported).
same handle on other registries
npm /~xuying1027: not found pypi /user/xuying1027: exists ↗ github.com/xuying1027: not found email domains
qq.com×42 webmail gmail.com×30 webmail 163.com×12 webmail outlook.com×6 webmail antgroup.com×6
yunji.me@outlook.com
also on 5 packages from 1 other publisher:
943720372@qq.com
also on 5 packages from 1 other publisher:
jinke.li666@gmail.com
also on 5 packages from 1 other publisher:
120635640@qq.com
also on 5 packages from 1 other publisher:
emails
yunji.me@outlook.com — @antv/f-wx, @antv/f-vue, @antv/f-react, @antv/f-my, @antv/f-lottie, @antv/f-engine 943720372@qq.com — @antv/f-wx, @antv/f-vue, @antv/f-react, @antv/f-my, @antv/f-lottie, @antv/f-engine jinke.li666@gmail.com — @antv/f-wx, @antv/f-vue, @antv/f-react, @antv/f-my, @antv/f-lottie, @antv/f-engine 120635640@qq.com — @antv/f-wx, @antv/f-vue, @antv/f-react, @antv/f-my, @antv/f-lottie, @antv/f-engine army8735@qq.com — @antv/f-wx, @antv/f-vue, @antv/f-react, @antv/f-my, @antv/f-lottie, @antv/f-engine dengfuping_private@163.com — @antv/f-wx, @antv/f-vue, @antv/f-react, @antv/f-my, @antv/f-lottie, @antv/f-engine afc163@gmail.com — @antv/f-wx, @antv/f-vue, @antv/f-react, @antv/f-my, @antv/f-lottie, @antv/f-engine chenluuli@gmail.com — @antv/f-wx, @antv/f-vue, @antv/f-react, @antv/f-my, @antv/f-lottie, @antv/f-engine 1175863618@qq.com — @antv/f-wx, @antv/f-vue, @antv/f-react, @antv/f-my, @antv/f-lottie, @antv/f-engine 1491812683@qq.com — @antv/f-wx, @antv/f-vue, @antv/f-react, @antv/f-my, @antv/f-lottie, @antv/f-engine // pattern footprint Static-analysis flags that fired across the campaign, with how many packages each touched. Use as the "what kind of stealer is this" answer.
// packages in this campaign 6 distinct · newest first ↳ author: https://github.com/orgs/antvis/people maintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com> ↗ registry ↳ author: https://github.com/orgs/antvis/people maintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com> ↗ registry ↳ author: https://github.com/orgs/antvis/people maintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com> ↗ registry army8735@qq.com
also on 5 packages from 1 other publisher:
dengfuping_private@163.com
also on 5 packages from 1 other publisher:
afc163@gmail.com
also on 5 packages from 1 other publisher:
chenluuli@gmail.com
also on 5 packages from 1 other publisher:
1175863618@qq.com
also on 5 packages from 1 other publisher:
1491812683@qq.com
also on 5 packages from 1 other publisher:
zhuyuxin0627@gmail.com
also on 5 packages from 1 other publisher:
ojh496845051@gmail.com
also on 5 packages from 1 other publisher:
wzwahl36@qq.com
also on 5 packages from 1 other publisher:
610999886@qq.com
also on 5 packages from 1 other publisher:
alex_zjt@163.com
also on 5 packages from 1 other publisher:
duxinyue.dxy@antgroup.com
also on 5 packages from 1 other publisher:
zhuyuxin0627@gmail.com — @antv/f-wx, @antv/f-vue, @antv/f-react, @antv/f-my, @antv/f-lottie, @antv/f-engine
ojh496845051@gmail.com — @antv/f-wx, @antv/f-vue, @antv/f-react, @antv/f-my, @antv/f-lottie, @antv/f-engine
wzwahl36@qq.com — @antv/f-wx, @antv/f-vue, @antv/f-react, @antv/f-my, @antv/f-lottie, @antv/f-engine
610999886@qq.com — @antv/f-wx, @antv/f-vue, @antv/f-react, @antv/f-my, @antv/f-lottie, @antv/f-engine
alex_zjt@163.com — @antv/f-wx, @antv/f-vue, @antv/f-react, @antv/f-my, @antv/f-lottie, @antv/f-engine
duxinyue.dxy@antgroup.com — @antv/f-wx, @antv/f-vue, @antv/f-react, @antv/f-my, @antv/f-lottie, @antv/f-engine author names
https://github.com/orgs/antvis/people — @antv/f-wx, @antv/f-vue, @antv/f-react, @antv/f-my, @antv/f-lottie, @antv/f-engine / npm / 2026-01-21 / MAL-2026-3884
@antv/f-my@1.10.0 by xuying1027
FEngine for alipay mini-program
child-process-spawn
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
↳ author: https://github.com/orgs/antvis/people maintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com> ↗ registry / npm / 2026-01-21 / MAL-2026-3883
@antv/f-lottie@1.10.0 by xuying1027
FEngine for Lottie
→ sends to https://f2.antv.vision
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
↳ author: https://github.com/orgs/antvis/people maintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com> ↗ registry / npm / 2026-01-21 / MAL-2026-3882
@antv/f-engine@1.10.0 by xuying1027
FEngine 是 AntV F 系列可视化引擎的底层渲染引擎，为移动端提供了一套完整的渲染、事件、动画能力，能方便的构建可视化 UI
→ sends to https://github.com/antvis/FEngine
reads-env-vars
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
↳ author: https://github.com/orgs/antvis/people maintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com> ↗ registry / npm / 2026-01-21 / MAL-2026-3888
@antv/f-wx@1.10.0 by xuying1027
FEngine for weixin mini-program
child-process-spawn
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
/ npm / 2026-01-21 / MAL-2026-3887
@antv/f-vue@1.10.0 by xuying1027
FEngine for Vue.js
→ sends to https://f2.antv.vision/zh/docs/tutorial/vue
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
/ npm / 2026-01-21 / MAL-2026-3885
@antv/f-react@1.10.0 by xuying1027
FEngine for React
→ sends to https://f2.antv.vision/zh/docs/tutorial/react
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
