// npm package
@antv/l7-layers
L7's collection of built-in layers
versions
566
maintainers
17
license
MIT
first publish
2019-11-20
publisher
lzxue
tarball
1,954,658 B
AUTO-PUBLISHED·2 versions indexed·latest published 2026-05-28
// publisher campaignby lzxue
9 caught packages from this accountThis is not an isolated catch. The same publisher has shipped 8 other packages that our pipeline flagged — the shape of a coordinated campaign, not a one-off. Each link below opens that sibling's analysis.
// offending code· @2.28.11· no static-pattern hits
llm: benign · 0.85→ No suspicious destination, no remote-exec shape — 2 known-vendor host(s).
- @2.28.11··AUTO-PUBLISHED·publisher: lzxueheuristic 75/100static flags 0llm benign (0.85) via ollamaknown-actor-stem-legit:teampcp:antvmature-packagehas-source-repoosv-flagged:MAL-2026-4041
→ No suspicious destination, no remote-exec shape — 2 known-vendor host(s).
// offending code· no static-pattern hits
--- package.json (entry) --- { "name": "@antv/l7-layers", "version": "2.28.11", "description": "L7's collection of built-in layers", "license": "MIT", "author": "https://github.com/orgs/antvis/people", "sideEffects": [ "./es/index.js" ], "main": "lib/index.js", "module": "es/index.js", "types": "es/index.d.ts", "files": [ "lib", "es" ], "dependencies": { "@antv/async-hook": "^2.2.9", "@babel/runtime": "^7.7.7", "@mapbox/martini": "^0.2.0", "@turf/clone": "^6.5.0", "@turf/helpers": "^6.1.4", "@turf/meta": "^6.0.2", "@turf/polygon-to-line": "^6.5.0", "@turf/union": "^6.5.0", "earcut": "^2.2.1", "eventemitter3": "^4.0.0", "gl-matrix": "^3.1.0", "@antv/l7-source": "2.28.11", "@antv/l7-utils": "2.28.11", "@antv/l7-core": "2.28.11", "@antv/l7-maps": "2.28.11" }, "devDependencies": { "@types/earcut": "^2.1.0", "@types/gl-matrix": "^2.4.5", "@antv/l7-test-utils": "^2.28.11" }, "publishConfig": { "access": "public", "registry": "https://registry.npmjs.org" }, "repository": "git@github.com:antvis/L7.git", "scripts": { "dev": "father dev", "build": "npm run clean && father build", --- index.js (entry) --- "use strict"; var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefault"); Object.defineProperty(exports, "__esModule", { value: true }); var _exportNames = { CanvasLayer: true, CityBuildingLayer: true, BaseLayer: true, BaseModel: true, GeometryLayer: true, HeatmapLayer: true, ImageLayer: true, LineLayer: true, PointLayer: true, PolygonLayer: true, RasterLayer: true, TileLayer: true, TileDebugLayer: true, EarthLayer: true, MaskLayer: true, WindLayer: true }; Object.defineProperty(exports, "BaseLayer", { enumerable: true, get: function () { return _BaseLayer.default; } }); Object.defineProperty(exports, "BaseModel", { enumerable: true, get: function () { return _BaseModel.default; } }); Object.defineProperty(exports, "CanvasLayer", { enumerable: true, get: function () { return _canvas.default; } }); Object.defineProperty(exports, "CityBuildingLayer", { enumerable: true, get: function () { return _building.default; } }); Object.defineProperty(exports, "EarthLayer", { enumerable: true, get: function () { return _earth.default; } }); Object.defineProperty(exports, "GeometryLaye --- bundled output (OSV-MAL flagged — LLM scope expansion) --- --- lib/utils/symbol-layout.js (bundled) --- "use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.getGlyphQuads = getGlyphQuads; exports.shapeText = shapeText; /** * 返回文本相对锚点位置 * @param {string} anchor 锚点位置 * @return {alignment} alignment */ function getAnchorAlignment(anchor) { let horizontalAlign = 0.5; let verticalAlign = 0.5; switch (anchor) { case 'right': case 'top-right': case 'bottom-right': horizontalAlign = 1; break; case 'left': case 'top-left': case 'bottom-left': horizontalAlign = 0; break; default: horizontalAlign = 0.5; } switch (anchor) { case 'top': case 'top-right': case 'top-left': verticalAlign = 1; break; case 'bottom': case 'bottom-right': case 'bottom-left': case 'bottom-center': verticalAlign = 0; break; default: verticalAlign = 0.5; } return { horizontalAlign, verticalAlign }; } // justify right = 1, left = 0, center = 0.5 function justifyLine(positionedGlyphs, glyphMap, start, end, justify) { if (!justify) { return; } const lastPositionedGlyph = positionedGlyphs[end]; const glyph = lastPositionedGlyph.glyph; if (glyph) { const lastAdvance = glyphMap[glyph].advance * lastPositionedGlyph.scale; const lineIndent = (positionedGlyphs[end].x + lastAdvance) * justify; for (let j = start; j <= end; j++) { positionedGlyphs[j].x -= lineIndent; } } } // justify right=1 left=0 center=0.5 // horizontalAlign right=1 left=0 center=0.5 // verticalAlign right=1 left=0 center=0.5 function align(positionedGlyphs, justify, horizontalAlign, verticalAlign, maxLineLength, lineHeight, lineCount, yOffset) { const shiftX = (justify - horizontalAlign) * maxLineLength; let shiftY = (-verticalAlign * lineCount + 0.5) * lineHeight; // 补偿 yOffset 使 top/bottom 锚点正确对齐 // top: 文字往下移 |yOffset| 像素(远离坐标点) // bottom: 文字往上移 |yOffset| 像素(远离坐标点) if (verticalAlign === 1) { shiftY += yOffset
