// npm package

@antv/translator

An translator for markdown files

npmjs.com tarball repo

weekly

649

monthly

1,342

versions

maintainers

license

ISC

first publish

2023-09-27

publisher

panyuqi

tarball

14,330 B

AUTO-PUBLISHED·1 version indexed·latest published 2023-09-27

// publisher campaignby panyuqi

9 caught packages from this account

This is not an isolated catch. The same publisher has shipped 8 other packages that our pipeline flagged — the shape of a coordinated campaign, not a one-off. Each link below opens that sibling's analysis.

// offending code· @1.0.1· no static-pattern hits

llm: benign · 0.85

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@1.0.1·2023-09-27·AUTO-PUBLISHED·publisher: panyuqi

heuristic 75/100

static flags 0

llm benign (0.85) via ollama

osv-flagged:MAL-2026-4091

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

// offending code· no static-pattern hits

--- package.json (entry) ---
{
  "name": "@antv/translator",
  "version": "1.0.1",
  "description": "An translator for markdown files",
  "main": "src/index.mjs",
  "bin": {
    "translate": "./src/index.mjs"
  },
  "keywords": [
    "cli",
    "npmtool"
  ],
  "author": "xiaoiver",
  "license": "ISC",
  "repository": "https://github.com/@antv/translator",
  "homepage": "https://github.com/@antv/translator",
  "dependencies": {
    "@tomsun28/google-translate-api": "1.1.2",
    "commander": "^11.0.0",
    "unified": "latest",
    "remark-parse": "latest",
    "glob": "latest",
    "remark-stringify": "latest",
    "unist-util-visit": "latest",
    "remark-gfm": "latest"
  },
  "devDependencies": {
    "@types/glob": "latest",
    "@types/node": "^20.7.0"
  }
}