// npm package

@antv/l7-react

L7-React 已全面升级为 LarkMap,不在进行维护。 LarkMap 空间数据可视分析组件库

npmjs.com tarball repo homepage

versions

maintainers

license

MIT

first publish

2020-02-12

publisher

lviser

tarball

208,379 B

AUTO-PUBLISHED·1 version indexed·latest published 2022-12-22

// publisher campaignby lviser

2 caught packages from this account

This is not an isolated catch. The same publisher has shipped 1 other package that our pipeline flagged — the shape of a coordinated campaign, not a one-off. Each link below opens that sibling's analysis.

// offending code· @2.4.3· 2 files flagged

llm: benign · 0.85

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s), 1 other host(s).

@2.4.3·2022-12-22·AUTO-PUBLISHED·publisher: lviser

heuristic 75/100

static flags 2

llm benign (0.85) via ollama

install-scripts:postinstallmature-packageosv-flagged:MAL-2026-4048install-path-npm-publishreads-env-vars

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s), 1 other host(s).

// offending code· 2 files flaggedpatterns: 2

--- install scripts ---
### postinstall
node -e "try{require('./postinstall')}catch(e){}" || exit 0



--- package/package.json (excerpt) ---
{
  "name": "@antv/l7-react",
  "version": "2.4.3",
  "license": "MIT",
  "repository": {
    "type": "git",
    "url": "https://github.com/antvis/L7-react"
  },
  "scripts": {
    "start": "dumi dev",
    "docs:build": "dumi build",
    "docs:deploy": "gh-pages -d docs-dist",
    "build": "father-build",
    "deploy": "npm run docs:build && npm run docs:deploy",
    "release": "npm run build && npm publish",
    "prettier": "prettier --write \"src/**/*.{js,jsx,tsx,ts,less,md,json}\"",
    "test": "umi-test",
    "test:coverage": "umi-test --coverage",
    "postinstall": "node -e \"try{require('./postinstall')}catch(e){}\" || exit 0"
  },
  "main": "lib/index.js",
  "module": "es/index.js",
  "typings": "lib/index.d.ts",
  "gitHooks": {
    "pre-commit": "lint-staged"
  },
  "files": [
    "dist",
    "lib",
    "es",
    "README.md",
    "postinstall.js"
  ],
  "lint-staged": {
    "*.{js,jsx,less,md,json}": [
      "prettier --write"
    ],
    "*.ts?(x)": [
      "prettier --parser=typescript --write"
    ]
  },
  "dependencies": {
    "@babel/runtime": "^7.7.7",
    "@types/eslint": "^8.4.1",
    "@types/lodash": "^4.14.180",
    "@types/mapbox-gl": "^1.11.2",
    "ahooks": "^2.6.1",
    "load-styles": "^2.0.0",
    "lodash": "^4.17.21"
  },
  "peerDependencies": {
    "@antv/l7": "^2.11.0",
    "mapbox-gl": "^1.2.1",
    "react": "^16.8.6 || ^17.0.2",
    "react-dom": "^16.8.6 || ^17.0.2"
  },
  "devDependencies": {
    "@types/react": "^17.0.40",
    "@antv/l7": "^2.11.

--- package/postinstall.js (excerpt) ---
function isTrue(value) {
  return !!value && value !== '0' && value !== 'false';
}

let envDisable = isTrue(process.env.CI);
let logLevel = process.env.npm_config_loglevel;
let logLevelDisplay = ['silent', 'error', 'warn'].indexOf(logLevel) > -1;

let BANNER = `\u001b[31m---------------------------------------------------------------------------------------
\u001b[31m---------------------------------------------------------------------------------------
\u001b[0mThank you for installing \u001b[35m${'@antv/l7-react'}\u001b[0m: built from \u001b[32m${'https://github.com/antvis/L7-react'}

\u001b[31m L7-React 全面升级为 LarkMap\u001b[32m (${'https://github.com/antvis/LarkMap'})\u001b[31m, \u001b[31mL7-React 已经停止维护! 请手动升级。

\u001b[0m\u001b[96mLarkMap 新一代 React 地图可视分析组件库，提供易用/丰富/易用/专业的可视化组件，一站式满足可视化需求。了解更多:
\u001b[0m> \u001b[32m${'https://larkmap.antv.antgroup.com/guide'}\u001b[0m
\u001b[31m---------------------------------------------------------------------------------------
\u001b[31m---------------------------------------------------------------------------------------\n`;

// install后在控制台输出一段日志
if (!envDisable && !logLevelDisplay) {
  console.log && console.log(BANNER);
}