// npm package

@antv/gi-assets-xlab

A G6VP asset for X-lab.

npmjs.com tarball repo homepage

versions

maintainers

license

MIT

first publish

2023-07-20

publisher

kopiluwaky

tarball

3,152,699 B

AUTO-PUBLISHED·1 version indexed·latest published 2023-09-06

// exfil path

what is read → where it ships

steals

○ clipboard

sends to

(no destination string extracted — payload may be dynamic / obfuscated)

evidence in excerpt

> "homepage": "https://github.com/X-lab2017/gi-assets-xlab#readme",
> "url": "https://github.com/X-lab2017/gi-assets-xlab/issues"
> "url": "git+https://github.com/X-lab2017/gi-assets-xlab.git"

→ view full payload

// publisher campaignby kopiluwaky

4 caught packages from this account

This is not an isolated catch. The same publisher has shipped 3 other packages that our pipeline flagged — the shape of a coordinated campaign, not a one-off. Each link below opens that sibling's analysis.

// offending code· @0.1.30· 2 files flagged

llm: benign · 0.85

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s), 1 other host(s).

@0.1.30·2023-09-06·AUTO-PUBLISHED·publisher: kopiluwaky

heuristic 75/100

static flags 2

llm benign (0.85) via ollama

mature-packageosv-flagged:MAL-2026-4010public-github-pushclipboard-access

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s), 1 other host(s).

// offending code· 2 files flaggedpatterns: 2

--- package/package.json (excerpt) ---
{
  "name": "@antv/gi-assets-xlab",
  "version": "0.1.30",
  "description": "A G6VP asset for X-lab.",
  "keywords": [
    "G6VP",
    "gi-asstes"
  ],
  "homepage": "https://github.com/X-lab2017/gi-assets-xlab#readme",
  "bugs": {
    "url": "https://github.com/X-lab2017/gi-assets-xlab/issues"
  },
  "repository": {
    "type": "git",
    "url": "git+https://github.com/X-lab2017/gi-assets-xlab.git"
  },
  "license": "MIT",
  "author": "",
  "main": "lib/index.js",
  "module": "es/index.js",
  "types": "lib/index.d.ts",
  "directories": {
    "lib": "lib"
  },
  "files": [
    "dist",
    "es",
    "lib"
  ],
  "scripts": {
    "build": "npm run clean && father build && npm run build:umd",
    "build:es": "father build",
    "build:umd": "webpack  --mode production  -c ./webpack.config.js",
    "clean": "rimraf es esm lib dist",
    "serve": "http-server dist -p 9527",
    "start": "umi dev",
    "start:node_version_18": "NODE_OPTIONS=--openssl-legacy-provider father build --watch"
  },
  "dependencies": {
    "@aligov/global-locale": "^1.0.5",
    "@aligov/global-string-format": "^1.0.7",
    "@antv/algorithm": "0.1.26-beta.0",
    "@antv/g2": "^5.0.16",
    "@antv/g6": "4.x",
    "@antv/gi-assets-basic": "latest",
    "@antv/gi-assets-neo4j": "latest",
    "@antv/gi-sdk": "^2.4.2",
    "@antv/gi-theme-antd": "latest",
    "@antv/graphin": "^2.7.14",
    "@types/react-dom": "latest",
    "ahooks": "^3.7.8",
    "antd": "4.x",
    "immer": "^9.0.0",
    "lodash": "^4.17.21",


--- package/lib/i18n/strings/en-US.json (excerpt) ---
{
  "gi-assets-xlab.components.Counter.Component.CustomAnalysisAssetsCounters": "Custom Analysis assets: counters",
  "gi-assets-xlab.components.Counter.info.Counter": "Counter",
  "gi-assets-xlab.components.Counter.registerMeta.CopyrightImage": "Copyright image",
  "gi-assets-xlab.components.Counter.registerMeta.Width": "Width",
  "gi-assets-xlab.components.Counter.registerMeta.Height": "Height",
  "gi-assets-xlab.components.Counter.registerMeta.Offset": "Offset",
  "gi-assets-xlab.components.Search.Component.EnterAName": "Enter a name",
  "gi-assets-xlab.components.Search.info.XlabSearchComponent": "Xlab search component",
  "gi-assets-xlab.components.Search.registerMeta.UpperLeft": "Upper left",
  "gi-assets-xlab.components.Search.registerMeta.UpperRight": "Upper right",
  "gi-assets-xlab.components.Search.registerMeta.LowerLeft": "Lower left",
  "gi-assets-xlab.components.Search.registerMeta.LowerRight": "Lower right",
  "gi-assets-xlab.components.Search.registerMeta.SearchService": "Search service",
  "gi-assets-xlab.components.Search.registerMeta.CypherQueryService": "Cypher Query Service",
  "gi-assets-xlab.components.Search.registerMeta.ComponentLocation": "Component location",
  "gi-assets-xlab.components.Search.registerMeta.Offset": "Offset",
  "gi-assets-xlab.components.Search.registerMeta.Width": "Width",
  "gi-assets-xlab.components.Search.registerMeta.Height": "Height",
  "gi-assets-xlab.components.Search.registerMeta.Small": "Small",
  "gi-assets-xlab.component