// npm package

@antv/l7-component

Component for L7

npmjs.com tarball repo homepage

weekly

50,445

monthly

188,225

versions

565

maintainers

license

MIT

first publish

2019-11-20

publisher

lzxue

tarball

563,893 B

AUTO-PUBLISHED·1 version indexed·latest published 2026-05-11

// publisher campaignby lzxue

9 caught packages from this account

This is not an isolated catch. The same publisher has shipped 8 other packages that our pipeline flagged — the shape of a coordinated campaign, not a one-off. Each link below opens that sibling's analysis.

// offending code· @2.25.10· no static-pattern hits

llm: benign · 0.85

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@2.25.10·2026-05-11·AUTO-PUBLISHED·publisher: lzxue

heuristic 75/100

static flags 0

llm benign (0.85) via ollama

popularity:very-highmature-packageosv-flagged:MAL-2026-4034

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

// offending code· no static-pattern hits

--- package.json (entry) ---
{
  "name": "@antv/l7-component",
  "version": "2.25.10",
  "description": "Component for L7",
  "license": "MIT",
  "author": "https://github.com/orgs/antvis/people",
  "sideEffects": [
    "*.css",
    "*.less",
    "*.js",
    "*/iconfont/*"
  ],
  "main": "lib/index.js",
  "module": "es/index.js",
  "types": "es/index.d.ts",
  "files": [
    "lib",
    "es"
  ],
  "dependencies": {
    "@babel/runtime": "^7.7.7",
    "eventemitter3": "^4.0.0",
    "supercluster": "^7.0.0",
    "@antv/l7-layers": "2.25.10",
    "@antv/l7-core": "2.25.10",
    "@antv/l7-utils": "2.25.10"
  },
  "devDependencies": {
    "less": "^4.1.3",
    "@antv/l7-test-utils": "^2.25.10"
  },
  "publishConfig": {
    "access": "public",
    "registry": "https://registry.npmjs.org"
  },
  "repository": "git@github.com:antvis/L7.git",
  "scripts": {
    "dev": "father dev",
    "prebuild:css": "lessc src/css/index.less src/css/index.css --source-map=none",
    "build": "npm run prebuild:css && npm run clean && father build",
    "check-deps": "father doctor",
    "lint": "eslint src __tests__",
    "clean": "rimraf dist es lib"
  }
}

--- index.js (entry) ---
"use strict";

var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefault");
Object.defineProperty(exports, "__esModule", {
  value: true
});
var _exportNames = {
  Marker: true,
  MarkerLayer: true,
  ExportImage: true,
  Fullscreen: true,
  GeoLocate: true,
  LayerSwitch: true,
  Logo: true,
  MapTheme: true,
  MouseLocation: true,
  Scale: true,
  Swipe: true,
  Zoom: true,
  LayerPopup: true,
  Popup: true
};
Object.defineProperty(exports, "ExportImage", {
  enumerable: true,
  get: function () {
    return _exportImage.ExportImage;
  }
});
Object.defineProperty(exports, "Fullscreen", {
  enumerable: true,
  get: function () {
    return _fullscreen.Fullscreen;
  }
});
Object.defineProperty(exports, "GeoLocate", {
  enumerable: true,
  get: function () {
    return _geoLocate.GeoLocate;
  }
});
Object.defineProperty(exports, "LayerPopup", {
  enumerable: true,
  get: function () {
    return _layerPopup.LayerPopup;
  }
});
Object.defineProperty(exports, "LayerSwitch", {
  enumerable: true,
  get: function () {
    return _layerSwitch.LayerSwitch;
  }
});
Object.defineProperty(exports, "Logo", {
  enumerable: true,
  get: function () {
    return _logo.Lo