// npm package

@antv/g6

A Graph Visualization Framework in JavaScript

npmjs.com tarball repo homepage

versions

521

maintainers

license

MIT

first publish

2017-04-11

publisher

iaaron

tarball

7,600,816 B

AUTO-PUBLISHED·1 version indexed·latest published 2026-05-08

// publisher campaignby iaaron

9 caught packages from this account

This is not an isolated catch. The same publisher has shipped 8 other packages that our pipeline flagged — the shape of a coordinated campaign, not a one-off. Each link below opens that sibling's analysis.

// offending code· @5.1.1· no static-pattern hits

llm: benign · 0.85

→ No suspicious destination, no remote-exec shape — 3 known-vendor host(s), 1 other host(s).

@5.1.1·2026-05-08·AUTO-PUBLISHED·publisher: iaaron

heuristic 75/100

static flags 0

llm benign (0.85) via ollama

mature-packageosv-flagged:MAL-2026-3982

→ No suspicious destination, no remote-exec shape — 3 known-vendor host(s), 1 other host(s).

// offending code· no static-pattern hits

--- package.json (entry) ---
{
  "name": "@antv/g6",
  "version": "5.1.1",
  "description": "A Graph Visualization Framework in JavaScript",
  "keywords": [
    "antv",
    "g6",
    "graph",
    "graph analysis",
    "graph editor",
    "graph visualization",
    "relational data"
  ],
  "homepage": "https://g6.antv.antgroup.com/",
  "bugs": {
    "url": "https://github.com/antvis/g6/issues"
  },
  "repository": {
    "type": "git",
    "url": "https://github.com/antvis/g6"
  },
  "license": "MIT",
  "author": "https://github.com/orgs/antvis/people",
  "main": "lib/index.js",
  "module": "esm/index.js",
  "types": "lib/index.d.ts",
  "files": [
    "src",
    "esm",
    "lib",
    "dist",
    "README"
  ],
  "dependencies": {
    "@antv/algorithm": "^0.1.26",
    "@antv/component": "^2.1.7",
    "@antv/event-emitter": "^0.1.3",
    "@antv/g": "^6.1.28",
    "@antv/g-canvas": "^2.0.48",
    "@antv/g-plugin-dragndrop": "^2.0.38",
    "@antv/graphlib": "^2.0.4",
    "@antv/hierarchy": "^0.7.1",
    "@antv/layout": "^2.0.0",
    "@antv/util": "^3.3.11",
    "bubblesets-js": "^2.3.4"
  },
  "devDependencies": {
    "@antv/g-svg": "^2.0.42",
    "@antv/g-webgl": "^2.0.52",
    "@antv/layout-gpu": "^1.1.7",
    "@an