home / campaigns / npm / GitHub Actions // publisher 캠페인 · npm
GitHub Actions npm의 GitHub Actions 계정이 publish한 catch 패키지 전체와, registry가 현재 노출하는 author·maintainer 정보. 같은 이메일이나 이름이 여러 패키지에 걸쳐 등장하면, 한 명이 여러 throwaway 계정을 운영한다는 강한 증거입니다.
활동 기간
2026-05-19 → 2026-06-05
최초 → 최근 탐지
npm 활동
이 에코시스템에서는 사용할 수 없습니다 (registry search 미지원).
다른 registry의 같은 핸들
npm /~GitHub Actions: 없음 pypi /user/GitHub Actions: 존재함 ↗ github.com/GitHub Actions: 없음 이메일 도메인
gmail.com×30 webmail qq.com×28 webmail autofleet.io×11 163.com×8 webmail outlook.com×4 webmail antgroup.com×4 sap.com×3 amazon.com×2 jagreehal.com×1 linuxfoundation.org×1 cdkinsights.dev×1 leepriest.dev×1 // exfil path what is read → where it ships steals
○ home dir○ system info○ clipboardsends to
(no destination string extracted — payload may be dynamic / obfuscated)
yunji.me@outlook.com
also on 5 packages from 1 other publisher:
943720372@qq.com
also on 5 packages from 1 other publisher:
jinke.li666@gmail.com
also on 5 packages from 1 other publisher:
120635640@qq.com
also on 5 packages from 1 other publisher:
emails
yunji.me@outlook.com — @antv/mcp-server-antv, @antv/s2-vue, @antv/s2, @antv/dumi-theme-antv 943720372@qq.com — @antv/mcp-server-antv, @antv/s2-vue, @antv/s2, @antv/dumi-theme-antv jinke.li666@gmail.com — @antv/mcp-server-antv, @antv/s2-vue, @antv/s2, @antv/dumi-theme-antv 120635640@qq.com — @antv/mcp-server-antv, @antv/s2-vue, @antv/s2, @antv/dumi-theme-antv army8735@qq.com — @antv/mcp-server-antv, @antv/s2-vue, @antv/s2, @antv/dumi-theme-antv dengfuping_private@163.com — @antv/mcp-server-antv, @antv/s2-vue, @antv/s2, @antv/dumi-theme-antv afc163@gmail.com — @antv/mcp-server-antv, @antv/s2-vue, @antv/s2, @antv/dumi-theme-antv chenluuli@gmail.com — @antv/mcp-server-antv, @antv/s2-vue, @antv/s2, @antv/dumi-theme-antv 1175863618@qq.com — @antv/mcp-server-antv, @antv/s2-vue, @antv/s2, @antv/dumi-theme-antv 1491812683@qq.com — @antv/mcp-server-antv, @antv/s2-vue, @antv/s2, @antv/dumi-theme-antv zhuyuxin0627@gmail.com // 패턴 풋프린트 캠페인 전반에서 어떤 정적 분석 플래그가 얼마나 자주 매칭됐는지. "이 캠페인이 결국 어떤 종류의 stealer인가"에 대한 요약 답.
// 이 캠페인의 패키지 고유 이름 11개 · 최신순 ↳ author: Jag Reehal <jag@jagreehal.com> maintainers: jagreehal <jag.reehal@gmail.com> ↗ registry ↳ author: opensearch-project maintainers: opensearch-project-bot <opensearch-infra@amazon.com>, peterzhuamazon <zhujiaxi@amazon.com>, thelinuxfoundation <admin@linuxfoundation.org> ↗ registry ↳ author: Lee Priest <lee@cdkinsights.dev> maintainers: leepriest <lee@leepriest.dev> ↗ registry ↳ author: Tanner Linsley maintainers: tannerlinsley <tannerlinsley@gmail.com>, alemtuzlak <t.zlak97@gmail.com>, kevinvandy <kevinvandy656@gmail.com> ↗ registry ↳ author: Scott Cooper <scttcper@gmail.com> maintainers: scttcper <scttcper@gmail.com> ↗ registry army8735@qq.com
also on 5 packages from 1 other publisher:
dengfuping_private@163.com
also on 5 packages from 1 other publisher:
afc163@gmail.com
also on 5 packages from 1 other publisher:
chenluuli@gmail.com
also on 5 packages from 1 other publisher:
1175863618@qq.com
also on 5 packages from 1 other publisher:
1491812683@qq.com
also on 5 packages from 1 other publisher:
zhuyuxin0627@gmail.com
also on 5 packages from 1 other publisher:
ojh496845051@gmail.com
also on 5 packages from 1 other publisher:
wzwahl36@qq.com
also on 5 packages from 1 other publisher:
610999886@qq.com
also on 5 packages from 1 other publisher:
alex_zjt@163.com
also on 5 packages from 1 other publisher:
duxinyue.dxy@antgroup.com
also on 5 packages from 1 other publisher:
— @antv/mcp-server-antv, @antv/s2-vue, @antv/s2, @antv/dumi-theme-antv
ojh496845051@gmail.com — @antv/mcp-server-antv, @antv/s2-vue, @antv/s2, @antv/dumi-theme-antv
wzwahl36@qq.com — @antv/mcp-server-antv, @antv/s2-vue, @antv/s2, @antv/dumi-theme-antv
610999886@qq.com — @antv/mcp-server-antv, @antv/s2-vue, @antv/s2, @antv/dumi-theme-antv
alex_zjt@163.com — @antv/mcp-server-antv, @antv/s2-vue, @antv/s2, @antv/dumi-theme-antv
duxinyue.dxy@antgroup.com — @antv/mcp-server-antv, @antv/s2-vue, @antv/s2, @antv/dumi-theme-antv author names
https://github.com/orgs/antvis/people — @antv/s2-vue, @antv/s2 / npm / 2026-05-26 / MAL-2026-4787
@autofleet/rabbit@5.6.0 by GitHub Actions
The breaking change in this version is the removal of `zehut` from dependencies and usage as a peer-dependency. The required version of zehut is now `^4.0.0`.
→ sends to https://github.com/Autofleet/autorepo.git
public-github-push
→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).
↳ author: maintainers: omergery <omergery@autofleet.io>, bosmat <bosmat@autofleet.io>, aaronlieblich <lieblichaaron@gmail.com>, nathanaf <nathan@autofleet.io>, dor_shay <dorshay6@gmail.com>, sephi-af <jjnjjn@gmail.com>, roei-autofleet <roei@autofleet.io>, itayankri <itay.ankri@gmail.com>, dsalti12 <dror@autofleet.io>, evanmyara <evank121@gmail.com>, shaktipada <shaktipada@autofleet.io>, oleg.drushits <olegdrushits@autofleet.io>, abir2 <abir@autofleet.io>, matanl2208 <matan@autofleet.io>, ofekrotem <ofekrotem@autofleet.io>, hilatd-autofleet <hilat@autofleet.io> ↗ registry / npm / 2026-05-18 / MAL-2026-4161
@cap-js/openapi@1.4.2 by GitHub Actions
CAP tool for OpenAPI
→ sends to https://github.com/cap-js/openapi.git
public-github-push
→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s), 1 other host(s).
↳ author: SAP SE maintainers: sap_extncrepos <mob.extrepo.stores@sap.com>, cap-npm <cap@sap.com>, sap-ospo-admin <ospo@sap.com> ↗ registry / npm / 2026-05-18 / MAL-2026-4077
@antv/s2@2.7.1 by GitHub Actions
effective spreadsheet render core lib
→ sends to https://s2.antv.antgroup.com
public-github-push clipboard-access reads-env-vars
→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s), 1 other host(s).
↳ author: https://github.com/orgs/antvis/people maintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com> ↗ registry / npm / 2026-03-31 / MAL-2026-4081
@antv/s2-vue@2.2.0 by GitHub Actions
use S2 with vue
→ sends to https://s2.antv.antgroup.com
public-github-push
→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s), 1 other host(s).
↳ author: https://github.com/orgs/antvis/people maintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com> ↗ registry / npm / 2026-04-27 / MAL-2026-4068
@antv/mcp-server-antv@0.1.8 by GitHub Actions
MCP Server for AntV visualization libraries development, which provides documentation context and examples for visualization developers.
→ sends to https://github.com/antvis/mcp-server-antv
install-path-npm-publish reads-env-vars
→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).
↳ author: AntV maintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com> ↗ registry / npm / 2026-04-16 / MAL-2026-3874
@antv/dumi-theme-antv@0.8.4 by GitHub Actions
AntV website theme based on dumi2.
→ sends to https://github.com/antvis/dumi-theme-antv#readme
→ 의심 전송지 없음, 원격 실행 형태 없음 — 3 known-vendor host(s), 2 other host(s).
↳ author: maintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com> ↗ registry / npm / 2026-01-15 / MAL-2026-5185
@jagreehal/workflow@1.16.0 by GitHub Actions
Typed async workflows with automatic error inference. Build type-safe workflows with Result types, step caching, resume state, and human-in-the-loop support.
public-github-push
/ npm / 2026-04-27 / MAL-2026-3434
@opensearch-project/opensearch@3.6.0 by GitHub Actions
The official OpenSearch client for Node.js
→ sends to https://www.opensearch.org/
public-github-push reads-env-vars base64-decode reads-homedir reads-system-info
→ 의심 전송지 없음, 원격 실행 형태 없음 — 3 other host(s).
/ npm / 2026-05-22 / MAL-2026-4508
cdk-insights@1.41.2 by GitHub Actions
AWS CDK security and cost analysis CLI. Free static scans via npm — no account needed. Sign up free to add AI-powered insights.
→ sends to https://s2zhmjbwlj.execute-api.eu-west-2.amazonaws.com/v1
public-github-push install-path-npm-publish
→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).
/ npm / 2026-05-22 / MAL-2026-3482
@tanstack/solid-router-devtools@2.0.0-beta.14 by GitHub Actions
Modern and scalable routing for Solid applications
→ sends to https://github.com/TanStack/router.git
public-github-push
→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).
/ npm / 2026-05-18 / MAL-2026-4377
@ctrl/plex@6.0.0 by GitHub Actions
Plex api client in typescript using ofetch
→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).
