// npm package

@antv/gi-assets-algorithm

G6VP 图分析算法资产库

npmjs.com tarball repo homepage

weekly

monthly

328

versions

maintainers

first publish

2022-11-09

publisher

iaaron

tarball

2,365,788 B

AUTO-PUBLISHED·1 version indexed·latest published 2024-08-06

// publisher campaignby iaaron

9 caught packages from this account

This is not an isolated catch. The same publisher has shipped 8 other packages that our pipeline flagged — the shape of a coordinated campaign, not a one-off. Each link below opens that sibling's analysis.

// offending code· @2.3.19· 1 file flagged

llm: benign · 0.85

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@2.3.19·2024-08-06·AUTO-PUBLISHED·publisher: iaaron

heuristic 75/100

static flags 1

llm benign (0.85) via ollama

mature-packageosv-flagged:MAL-2026-4000public-github-push

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

// offending code· 1 file flaggedpatterns: 1

--- package/package.json (excerpt) ---
{
  "name": "@antv/gi-assets-algorithm",
  "version": "2.3.19",
  "description": "G6VP 图分析算法资产库",
  "repository": {
    "type": "git",
    "url": "https://github.com/antvis/G6VP.git"
  },
  "sideEffects": [
    "*.css",
    "*.less"
  ],
  "author": "yifeng.dst <yifeng.dst@antgroup.com>",
  "main": "lib/index.js",
  "module": "es/index.js",
  "types": "lib/index.d.ts",
  "files": [
    "dist",
    "es",
    "lib"
  ],
  "dependencies": {
    "@aligov/global-locale": "^1.0.5",
    "@aligov/global-string-format": "^1.0.7",
    "@ant-design/icons": "^4.7.0",
    "@antv/algorithm": "^0.1.26-beta.0",
    "@antv/g2plot": "^2.4.31",
    "@antv/matrix-util": "^3.0.4",
    "@antv/s2": "^1.48.0",
    "@antv/s2-react": "^1.41.0",
    "ahooks": "^3.7.7",
    "deepmerge": "^4.2.2",
    "lodash": "^4.17.21",
    "use-immer": "^0.9.0",
    "@antv/gi-common-components": "1.3.16",
    "@antv/gi-sdk": "2.4.23"
  },
  "peerDependencies": {
    "@ant-design/icons": "^4.7.0",
    "@antv/g2plot": "^2.4.31",
    "@antv/graphin": "^2.7.27",
    "react": "17.x",
    "react-dom": "17.x"
  },
  "publishConfig": {
    "access": "public"
  },
  "scripts": {
    "build": "npm run clean && npm run build:es & npm run build:umd",
    "build:es": "father build",
    "build:umd": "webpack  --mode production  -c ../../webpack.config.js --env path=/packages/gi-assets-algorithm",
    "build:umd:analysis": "webpack  --mode production  -c ../../webpack.config.js --env path=/packages/gi-assets-algorithm analysis=tru