// npm package

@antv/g-perf

Performance monitor for G.

npmjs.com tarball

versions

maintainers

license

MIT

first publish

2019-07-18

publisher

atool

tarball

9,883 B

AUTO-PUBLISHED·1 version indexed·latest published 2019-07-18

// publisher campaignby atool

9 caught packages from this account

This is not an isolated catch. The same publisher has shipped 8 other packages that our pipeline flagged — the shape of a coordinated campaign, not a one-off. Each link below opens that sibling's analysis.

// offending code· @1.0.0· no static-pattern hits

llm: benign · 0.85

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@1.0.0·2019-07-18·AUTO-PUBLISHED·publisher: atool

heuristic 75/100

static flags 0

llm benign (0.85) via ollama

first-version-of-packagepublisher-multi-name-burst:5osv-flagged:MAL-2026-3930

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

// offending code· no static-pattern hits

--- package.json (entry) ---
{
  "name": "@antv/g-perf",
  "version": "1.0.0",
  "description": "Performance monitor for G.",
  "main": "lib/index.js",
  "scripts": {
    "tsc": "tsc --noEmit",
    "build": "rm -rf lib && tsc"
  },
  "devDependencies": {
    "typescript": "^3.5.3"
  },
  "keywords": [
    "G",
    "perf",
    "monitor"
  ],
  "author": "antv",
  "license": "MIT"
}


--- index.js (entry) ---
"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
var gp_1 = require("./gp");
exports.default = gp_1.GP;