// npm package

@antv/f-charts

npmjs.com tarball repo

weekly

monthly

versions

maintainers

first publish

2022-06-24

publisher

zengyue

tarball

6,135 B

AUTO-PUBLISHED·1 version indexed·latest published 2022-06-24

// publisher campaignby zengyue

9 caught packages from this account

This is not an isolated catch. The same publisher has shipped 8 other packages that our pipeline flagged — the shape of a coordinated campaign, not a one-off. Each link below opens that sibling's analysis.

// offending code· @0.0.0· no static-pattern hits

llm: benign · 0.85

→ No suspicious destination, no remote-exec shape — 2 known-vendor host(s).

@0.0.0·2022-06-24·AUTO-PUBLISHED·publisher: zengyue

heuristic 75/100

static flags 0

llm benign (0.85) via ollama

first-version-of-packageosv-flagged:MAL-2026-3881

→ No suspicious destination, no remote-exec shape — 2 known-vendor host(s).

// offending code· no static-pattern hits

--- package.json (entry) ---
{
  "name": "@antv/f-charts",
  "version": "0.0.0",
  "main": "lib/index.js",
  "module": "es/index.js",
  "types": "es/index.d.ts",
  "dependencies": {
    "@antv/f-engine": "*",
    "@antv/f2": "*",
    "@babel/runtime": "^7.12.5"
  },
  "devDependencies": {},
  "homepage": "https://github.com/antvis/FEngine",
  "author": "https://github.com/orgs/antvis/people",
  "repository": {
    "type": "git",
    "url": "https://github.com/antvis/FEngine"
  },
  "bugs": {
    "url": "https://github.com/antvis/FEngine/issues"
  }
}


--- index.js (entry) ---
"use strict";

Object.defineProperty(exports, "__esModule", {
  value: true
});
var _exportNames = {
  Canvas: true,
  Chart: true
};
Object.defineProperty(exports, "Canvas", {
  enumerable: true,
  get: function get() {
    return _f.Canvas;
  }
});
Object.defineProperty(exports, "Chart", {
  enumerable: true,
  get: function get() {
    return _f.Chart;
  }
});

var _fEngine = require("@antv/f-engine");

Object.keys(_fEngine).forEach(function (key) {
  if (key === "default" || key === "__esModule") return;
  if (Object.prototype.hasOwnProperty.call(_exportNames, key)) return;
  if (key in exports && exports[key] === _fEngine[key]) return;
  Object.defineProperty(exports, key, {
    enumerable: true,
    get: function get() {
      return _fEngine[key];
    }
  });
});

var _f = require("@antv/f2");

var _components = require("./components");

Object.keys(_components).forEach(function (key) {
  if (key === "default" || key === "__esModule") return;
  if (Object.prototype.hasOwnProperty.call(_exportNames, key)) return;
  if (key in exports && exports[key] === _components[key]) return;
  Object.defineProperty(exports, key, {
    enumerable: true,
    get: function get() {
      retu