// npm package

@antv/x6

JavaScript diagramming library that uses SVG and HTML for rendering

npmjs.com tarball repo homepage

versions

426

maintainers

license

MIT

first publish

2019-12-01

publisher

gaofuhong

tarball

8,558,752 B

AUTO-PUBLISHED·1 version indexed·latest published 2026-03-18

// exfil path

what is read → where it ships

steals

○ clipboard

sends to

(no destination string extracted — payload may be dynamic / obfuscated)

→ view full payload

// publisher campaignby gaofuhong

4 caught packages from this account

This is not an isolated catch. The same publisher has shipped 3 other packages that our pipeline flagged — the shape of a coordinated campaign, not a one-off. Each link below opens that sibling's analysis.

// offending code· @3.1.7· 2 files flagged

llm: benign · 0.85

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@3.1.7·2026-03-18·AUTO-PUBLISHED·publisher: gaofuhong

heuristic 75/100

static flags 2

llm benign (0.85) via ollama

mature-packageosv-flagged:MAL-2026-3839public-github-pushclipboard-access

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

// offending code· 2 files flaggedpatterns: 2

--- package/package.json (excerpt) ---
{
  "name": "@antv/x6",
  "version": "3.1.7",
  "description": "JavaScript diagramming library that uses SVG and HTML for rendering",
  "main": "lib/index.js",
  "module": "es/index.js",
  "unpkg": "dist/x6.min.js",
  "jsdelivr": "dist/x6.min.js",
  "types": "lib/index.d.ts",
  "type": "module",
  "files": [
    "dist",
    "es",
    "lib",
    "src"
  ],
  "keywords": [
    "graph",
    "diagram",
    "flowchart",
    "uml",
    "x6-editor",
    "editor",
    "svg",
    "x6",
    "antv"
  ],
  "dependencies": {
    "dom-align": "^1.12.4",
    "lodash-es": "^4.17.15",
    "mousetrap": "^1.6.5",
    "utility-types": "^3.10.0"
  },
  "devDependencies": {
    "@biomejs/biome": "^2.2.2",
    "@commitlint/config-conventional": "^19.8.1",
    "@napi-rs/canvas": "^0.1.77",
    "@rollup/plugin-commonjs": "^28.0.6",
    "@rollup/plugin-json": "^6.1.0",
    "@rollup/plugin-node-resolve": "^16.0.1",
    "@rollup/plugin-terser": "^0.4.4",
    "@testing-library/jest-dom": "^6.7.0",
    "@types/lodash-es": "^4.17.12",
    "@types/mousetrap": "^1.6.11",
    "@types/node": "^24.3.0",
    "@vitest/coverage-v8": "3.2.4",
    "jsdom": "^24.0.0",
    "limit-size": "^0.1.4",
    "lint-staged": "^16.1.5",
    "npm-run-all": "^4.1.5",
    "rimraf": "^6.0.1",
    "rollup": "^4.48.1",
    "rollup-plugin-typescript2": "^0.35.0",
    "rollup-plugin-visualizer": "^5.14.0",
    "sinon": "^21.0.0",
    "svgo": "^4.0.0",
    "tslib": "^2.8.1",
    "typescript": "^5.9.2",
    "vitest": "^3.2.4"
  },
  "limi

--- package/src/plugin/index.ts (excerpt) ---
export { Clipboard } from './clipboard'
export { Dnd } from './dnd'
export { Export } from './export'
export { History } from './history'
export { Keyboard } from './keyboard'
export { Selection } from './selection'
export { MiniMap } from './minimap'
export { Scroller } from './scroller'
export { Stencil } from './stencil'
export { Snapline } from './snapline'
export { Transform } from './transform'