// npm package

@antv/l7-pass

## Getting Started

npmjs.com tarball

versions

maintainers

first publish

2022-02-16

publisher

yiqianyao

tarball

3,277 B

AUTO-PUBLISHED·1 version indexed·latest published 2022-02-16

// publisher campaignby yiqianyao

2 caught packages from this account

This is not an isolated catch. The same publisher has shipped 1 other package that our pipeline flagged — the shape of a coordinated campaign, not a one-off. Each link below opens that sibling's analysis.

// offending code· @1.0.0· 1 file flagged

llm: benign · 0.85

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@1.0.0·2022-02-16·AUTO-PUBLISHED·publisher: yiqianyao

heuristic 75/100

static flags 1

llm benign (0.85) via ollama

first-version-of-packageosv-flagged:MAL-2026-4047install-path-npm-publish

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

// offending code· 1 file flaggedpatterns: 1

--- install scripts ---
### prepublishOnly
npm run build



--- package/package.json (excerpt) ---
{
  "name": "@antv/l7-pass",
  "version": "1.0.0",
  "scripts": {
    "start": "dumi dev",
    "docs:build": "dumi build",
    "docs:deploy": "gh-pages -d docs-dist",
    "build": "father-build",
    "deploy": "npm run docs:build && npm run docs:deploy",
    "prettier": "prettier --write \"**/*.{js,jsx,tsx,ts,less,md,json}\"",
    "test": "umi-test",
    "test:coverage": "umi-test --coverage",
    "release": "npm run build && npm publish --access public",
    "prepublishOnly": "npm run build"
  },
  "module": "es/index.js",
  "typings": "es/index.d.ts",
  "gitHooks": {
    "pre-commit": "lint-staged"
  },
  "lint-staged": {
    "*.{js,jsx,less,md,json}": [
      "prettier --write"
    ],
    "*.ts?(x)": [
      "prettier --parser=typescript --write"
    ]
  },
  "dependencies": {
    "react": "^16.12.0 || ^17.0.0"
  },
  "devDependencies": {
    "@testing-library/jest-dom": "^5.15.1",
    "@testing-library/react": "^12.1.2",
    "@types/jest": "^27.0.3",
    "@umijs/fabric": "^2.8.1",
    "@umijs/test": "^3.0.5",
    "dumi": "^1.1.0",
    "father-build": "^1.17.2",
    "gh-pages": "^3.0.0",
    "lint-staged": "^10.0.7",
    "prettier": "^2.2.1",
    "yorkie": "^2.0.0"
  }
}


--- package.json (entry) ---
{
  "name": "@antv/l7-pass",
  "version": "1.0.0",
  "scripts": {
    "start": "dumi dev",
    "docs:build": "dumi build",
    "docs:deploy": "gh-pages -d docs-dist",
    "build": "father-build",
    "deploy": "npm run docs:build && npm run docs:deploy",
    "prettier": "prettier --write \"**/*.{js,jsx,tsx,ts,less,md,json}\"",
    "test": "umi-test",
    "test:coverage": "umi-test --coverage",
    "release": "npm run build && npm publish --access public",
    "prepublishOnly": "npm run build"
  },
  "module": "es/index.js",
  "typings": "es/index.d.ts",
  "gitHooks": {
    "pre-commit": "lint-staged"
  },
  "lint-staged": {
    "*.{js,jsx,less,md,json}": [
      "prettier --write"
    ],
    "*.ts?(x)": [
      "prettier --parser=typescript --write"
    ]
  },
  "dependencies": {
    "react": "^16.12.0 || ^17.0.0"
  },
  "devDependencies": {
    "@testing-library/jest-dom": "^5.15.1",
    "@testing-library/react": "^12.1.2",
    "@types/jest": "^27.0.3",
    "@umijs/fabric": "^2.8.1",
    "@umijs/test": "^3.0.5",
    "dumi": "^1.1.0",
    "father-build": "^1.17.2",
    "gh-pages": "^3.0.0",
    "lint-staged": "^10.0.7",
    "prettier": "^2.2.1",
    "yorkie": "^2.0.0"
  }
}