// npm package

@antv/awards

Grant the AntV badge to GitHub users

npmjs.com tarball repo homepage

versions

maintainers

license

MIT

first publish

2024-12-13

publisher

iaaron

tarball

250,446 B

AUTO-PUBLISHED·1 version indexed·latest published 2024-12-18

// publisher campaignby iaaron

9 caught packages from this account

This is not an isolated catch. The same publisher has shipped 8 other packages that our pipeline flagged — the shape of a coordinated campaign, not a one-off. Each link below opens that sibling's analysis.

// offending code· @0.0.9· no static-pattern hits

llm: benign · 0.85

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@0.0.9·2024-12-18·AUTO-PUBLISHED·publisher: iaaron

heuristic 75/100

static flags 0

llm benign (0.85) via ollama

osv-flagged:MAL-2026-3855

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

// offending code· no static-pattern hits

--- package.json (entry) ---
{
  "name": "@antv/awards",
  "version": "0.0.9",
  "description": "Grant the AntV badge to GitHub users",
  "main": "index.js",
  "scripts": {
    "build": "node ./scripts/build.js",
    "readme": "node ./scripts/readme.js",
    "test": "node ./scripts/test.js",
    "award": "node ./scripts/add-badge.js",
    "release": "bash ./scripts/release.sh",
    "sync": "node ./scripts/sync-antv.js"
  },
  "keywords": [
    "AntV",
    "awards",
    "badge"
  ],
  "files": [
    "*.json"
  ],
  "author": "Aarebecca",
  "license": "MIT",
  "devDependencies": {
    "dotenv": "^16.4.7",
    "inquirer": "^12.2.0",
    "node-fetch": "^2.7.0"
  },
  "publishConfig": {
    "access": "public"
  },
  "repository": "git@github.com:antvis/awards.git"
}