// npm package

@antv/f2-react

F2 for React

npmjs.com tarball repo homepage

versions

140

maintainers

license

MIT

first publish

2021-11-10

publisher

zengyue

tarball

14,453 B

AUTO-PUBLISHED·1 version indexed·latest published 2025-11-10

// publisher campaignby zengyue

9 caught packages from this account

This is not an isolated catch. The same publisher has shipped 8 other packages that our pipeline flagged — the shape of a coordinated campaign, not a one-off. Each link below opens that sibling's analysis.

// offending code· @5.14.0· no static-pattern hits

llm: benign · 0.85

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@5.14.0·2025-11-10·AUTO-PUBLISHED·publisher: zengyue

heuristic 75/100

static flags 0

llm benign (0.85) via ollama

mature-packageosv-flagged:MAL-2026-3895

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

// offending code· no static-pattern hits

--- package.json (entry) ---
{
  "name": "@antv/f2-react",
  "version": "5.14.0",
  "description": "F2 for React",
  "main": "lib/index.js",
  "module": "es/index.js",
  "types": "es/index.d.ts",
  "sideEffects": false,
  "keywords": [
    "antv",
    "f2",
    "chart",
    "charts",
    "mobile",
    "visualization",
    "react"
  ],
  "dependencies": {
    "@antv/f-react": "^1.0.1",
    "@antv/f2": "5.14.0",
    "@babel/runtime": "^7.12.5",
    "tslib": "^2.3.1"
  },
  "devDependencies": {
    "@types/react": "^16.9.35",
    "@types/react-dom": "^16.9.8",
    "enzyme": "^3.11.0",
    "enzyme-adapter-react-16": "^1.15.6",
    "react": "16.8.6",
    "react-dom": "16.8.6"
  },
  "homepage": "https://f2.antv.vision/zh/docs/tutorial/react",
  "author": "https://github.com/orgs/antvis/people",
  "license": "MIT",
  "repository": {
    "type": "git",
    "url": "https://github.com/antvis/f2"
  },
  "bugs": {
    "url": "https://github.com/antvis/f2/issues"
  },
  "gitHead": "a9a4c397f067aafad8c050d370b8081efca9d199"
}


--- index.js (entry) ---
"use strict";

Object.defineProperty(exports, "__esModule", {
  value: true
});
Object.defineProperty(exports, "createCanvas", {
  enumerable: true,
  get: function get() {
    return _fReact.createCanvas;
  }
});
exports.default = void 0;
var _f = require("@antv/f2");
var _fReact = require("@antv/f-react");
var _default = exports.default = (0, _fReact.createCanvas)(_f.Canvas);