// npm package

@antv/graphin-icons

graphin icon fonts

npmjs.com tarball

versions

maintainers

license

ISC

first publish

2021-01-20

publisher

pomelo-nwu

tarball

76,757 B

AUTO-PUBLISHED·1 version indexed·latest published 2021-01-20

// publisher campaignby pomelo-nwu

3 caught packages from this account

This is not an isolated catch. The same publisher has shipped 2 other packages that our pipeline flagged — the shape of a coordinated campaign, not a one-off. Each link below opens that sibling's analysis.

// offending code· @1.0.0· no static-pattern hits

llm: benign · 0.85

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@1.0.0·2021-01-20·AUTO-PUBLISHED·publisher: pomelo-nwu

heuristic 75/100

static flags 0

llm benign (0.85) via ollama

first-version-of-packageosv-flagged:MAL-2026-4025

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

// offending code· no static-pattern hits

--- package.json (entry) ---
{
  "name": "@antv/graphin-icons",
  "version": "1.0.0",
  "description": "graphin icon fonts",
  "main": "./dist/index",
  "scripts": {
    "start": "father build --watch",
    "build": "father build",
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "sideEffects": [
    "*.css"
  ],
  "author": "",
  "license": "ISC",
  "publishConfig": {
    "access": "public"
  },
  "devDependencies": {
    "father": "^2.30.0"
  }
}


--- index.js (entry) ---
var id = "1522921";
var name = "graphin";
var font_family = "graphin";
var css_prefix_text = "icon-";
var description = "";
var glyphs = [
	{
		icon_id: "4765721",
		name: "check-circle",
		font_class: "check-circle",
		unicode: "e77d",
		unicode_decimal: 59261
	},
	{
		icon_id: "4765722",
		name: "CI",
		font_class: "CI",
		unicode: "e77e",
		unicode_decimal: 59262
	},
	{
		icon_id: "4765723",
		name: "Dollar",
		font_class: "Dollar",
		unicode: "e77f",
		unicode_decimal: 59263
	},
	{
		icon_id: "4765724",
		name: "compass",
		font_class: "compass",
		unicode: "e780",
		unicode_decimal: 59264
	},
	{
		icon_id: "4765725",
		name: "close-circle",
		font_class: "close-circle",
		unicode: "e781",
		unicode_decimal: 59265
	},
	{
		icon_id: "4765726",
		name: "frown",
		font_class: "frown",
		unicode: "e782",
		unicode_decimal: 59266
	},
	{
		icon_id: "4765727",
		name: "info-circle",
		font_class: "info-circle",
		unicode: "e783",
		unicode_decimal: 59267
	},
	{
		icon_id: "4765728",
		name: "left-circle",
		font_class: "left-circle",
		unicode: "e784",
		unicode_decimal: 59268
	},
	{
		icon_id: "4765729",
		name: "down-circle",
		font_class: "down-circle",
		unicode: "e785",
		unicode

--- bundled output (OSV-MAL flagged — LLM scope expansion) ---

--- dist/index.d.ts (bundled) ---
import './index.less';
declare const _default: () => {
    fontFamily: string;
    glyphs: {
        icon_id: string;
        name: string;
        font_class: string;
        unicode: string;
        unicode_decimal: number;
    }[];
};
export default _default;


--- dist/index.js (bundled) ---
var id = "1522921";
var name = "graphin";
var font_family = "graphin";
var css_prefix_text = "icon-";
var description = "";
var glyphs = [
	{
		icon_id: "4765721",
		name: "check-circle",
		font_class: "check-circle",
		unicode: "e77d",
		unicode_decimal: 59261
	},
	{
		icon_id: "4765722",
		name: "CI",
		font_class: "CI",
		unicode: "e77e",
		unicode_decimal: 59262
	},
	{
		icon_id: "4765723",
		name: "Dollar",
		font_class: "Dollar",
		unicode: "e77f",
		unicode_decimal: 59263
	},
	{
		icon_id: "4765724",
		name: "compass",
		font_class: "compass",
		unicode: "e780",
		unicode_decimal: 59264
	},
	{
		icon_id: "4765725",
		name: "close-circle",
		font_class: "close-circle",
		unicode: "e781",
		unicode_decimal: 59265
	},
	{
		icon_id: "4765726",
		name: "frown",
		font_class: "frown",
		unicode: "e782",
		unicode_decimal: 59266
	},
	{
		icon_id: "4765727",
		name: "info-circle",
		font_class: "info-circle",
		unicode: "e783",
		unicode_decimal: 59267
	},
	{
		icon_id: "4765728",
		name: "left-circle",
		font_class: "left-circle",
		unicode: "e784",
		unicode_decimal: 59268
	},
	{
		icon_id: "4765729",
		name: "down-circle",
		font_class: "down-circle",
		unicode: "e785",
		unicode_decimal: 59269
	},
	{
		icon_id: "4765730",
		name: "EURO",
		font_class: "EURO",
		unicode: "e786",
		unicode_decimal: 59270
	},
	{
		icon_id: "4765731",
		name: "copyright",
		font_class: "copyright",
		unicode: "e787",
		unicode_decimal: 59271
	},
	{
		icon_id: "4765732",
		name: "minus-circle",
		font_class: "minus-circle",
		unicode: "e788",
		unicode_decimal: 59272
	},
	{
		icon_id: "4765733",
		name: "meh",
		font_class: "meh",
		unicode: "e789",
		unicode_decimal: 59273
	},
	{
		icon_id: "4765734",
		name: "plus-circle",
		font_class: "plus-circle",
		unicode: "e78a",
		unicode_decimal: 59274
	},
	{
		icon_id: "4765735",
		name: "play-circle",
		font_class: "play-circle",
		unicode: "e78b",
		unicode_decimal: 59275
	},
	{
		icon_id: "4765736",
		name: "question-circle",
		font_cla