// npm 패키지

@antv/gi-assets-advance

G6VP 高级资产包

npmjs.com tarball repo homepage

버전

메인테이너

최초 publish

2022-11-09

publisher

iaaron

tarball

8,276,872 B

AUTO-PUBLISHED·1개 버전 인덱싱됨·최근 publish: 2024-08-06

// exfil path

what is read → where it ships

steals

○ clipboard

sends to

(no destination string extracted — payload may be dynamic / obfuscated)

→ view full payload

// publisher 캠페인by iaaron

이 계정에서 catch된 패키지 9건

고립된 catch가 아닙니다. 동일 publisher가 8개의 다른 패키지를 추가로 발행했고, 모두 파이프라인이 catch했습니다 — 일회성이 아닌 조직적 캠페인의 형태. 아래 링크는 각 형제 catch의 분석으로 이동합니다.

// offending code· @2.5.22· 2 files flagged

llm: benign · 0.85

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

@2.5.22·2024-08-06·AUTO-PUBLISHED·publisher: iaaron

heuristic 75/100

static flags 1

llm benign (0.85) via ollama

mature-packageosv-flagged:MAL-2026-3838clipboard-access

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

// offending code· 2 files flaggedpatterns: 1

--- package/package.json (excerpt) ---
{
  "name": "@antv/gi-assets-advance",
  "version": "2.5.22",
  "description": "G6VP 高级资产包",
  "main": "lib/index.js",
  "module": "es/index.js",
  "types": "lib/index.d.ts",
  "sideEffects": [
    "*.css",
    "*.less"
  ],
  "files": [
    "es",
    "lib",
    "dist"
  ],
  "dependencies": {
    "@aligov/global-locale": "^1.0.5",
    "@aligov/global-string-format": "^1.0.7",
    "@ant-design/icons": "^4.7.0",
    "@antv/algorithm": "^0.1.26-beta.0",
    "@antv/g2plot": "^2.4.31",
    "@antv/graphin-icons": "^1.0.0",
    "@antv/util": "^3.2.5",
    "@uiw/react-markdown-preview": "^4.1.13",
    "ace-gremlin-editor": "^0.0.14",
    "ahooks": "^3.7.7",
    "codemirror": "^5.25.0",
    "copy-to-clipboard": "^3.3.2",
    "cypher-editor-support": "^1.1.10",
    "d3-scale": "^4.0.0",
    "deepmerge": "^4.2.2",
    "element-resize-detector": "^1.2.4",
    "immer": "^9.0.0",
    "insert-css": "^2.0.0",
    "lodash": "^4.17.21",
    "nanoid": "^4.0.0",
    "query-string": "^7.1.1",
    "react-draggable": "^4.4.5",
    "react-force-graph-3d": "^1.21.10",
    "react-json-view": "^1.21.3",
    "react-spring": "9.6.0",
    "react-transition-group": "^4.4.5",
    "size-sensor": "^1.0.1",
    "use-immer": "^0.9.0",
    "@antv/gi-common-components": "1.3.16",
    "@antv/gi-sdk": "2.4.23"
  },
  "peerDependencies": {
    "@antv/graphin": "^2.7.27",
    "antd": "4.x",
    "react": "17.x",
    "react-dom": "17.x"
  },
  "publishConfig": {
    "access": "public"
  },
  "repository": "git@github.

--- package/lib/components/TemplateQuery/Component.js (excerpt) ---
"use strict";

function _typeof(o) { "@babel/helpers - typeof"; return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) { return typeof o; } : function (o) { return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o; }, _typeof(o); }
Object.defineProperty(exports, "__esModule", {
  value: true
});
exports.default = void 0;
var _giSdk = require("@antv/gi-sdk");
var _antd = require("antd");
var _copyToClipboard = _interopRequireDefault(require("copy-to-clipboard"));
var _queryString = _interopRequireDefault(require("query-string"));
var _react = _interopRequireWildcard(require("react"));
var _useImmer3 = require("use-immer");
var _i18n = _interopRequireDefault(require("../../i18n"));
require("./index.less");
function _getRequireWildcardCache(e) { if ("function" != typeof WeakMap) return null; var r = new WeakMap(), t = new WeakMap(); return (_getRequireWildcardCache = function _getRequireWildcardCache(e) { return e ? t : r; })(e); }
function _interopRequireWildcard(e, r) { if (!r && e && e.__esModule) return e; if (null === e || "object" != _typeof(e) && "function" != typeof e) return { default: e }; var t = _getRequireWildcardCache(r); if (t && t.has(e)) return t.get(e); var n = { __proto__: null }, a = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var u in e) if ("default" !== u && {}.hasOwnProperty.call(e, u)) { var i = a ? Object.getOwnPropertyDescriptor(e, u