// npm package

@antv/x6-react

Use X6 with react

npmjs.com tarball repo homepage

versions

maintainers

license

MIT

first publish

2020-10-30

publisher

bubkoo

tarball

6,835 B

AUTO-PUBLISHED·1 version indexed·latest published 2020-11-17

// publisher campaignby bubkoo

3 caught packages from this account

This is not an isolated catch. The same publisher has shipped 2 other packages that our pipeline flagged — the shape of a coordinated campaign, not a one-off. Each link below opens that sibling's analysis.

// offending code· @0.1.26· 1 file flagged

llm: benign · 0.85

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@0.1.26·2020-11-17·AUTO-PUBLISHED·publisher: bubkoo

heuristic 75/100

static flags 1

llm benign (0.85) via ollama

mature-packageosv-flagged:MAL-2026-4112public-github-push

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

// offending code· 1 file flaggedpatterns: 1

--- install scripts ---
### prepare
yarn build



--- package/package.json (excerpt) ---
{
  "name": "@antv/x6-react",
  "version": "0.1.26",
  "description": "Use X6 with react",
  "main": "lib/index.js",
  "module": "es/index.js",
  "unpkg": "dist/x6-react.js",
  "types": "lib/index.d.ts",
  "files": [
    "dist",
    "es",
    "lib"
  ],
  "keywords": [
    "x6",
    "react",
    "render",
    "antv"
  ],
  "scripts": {
    "clean": "rimraf dist es lib",
    "lint": "tslint -c tslint.json -p tsconfig.json --fix",
    "watch": "watch 'yarn build' ./src",
    "build:esm": "tsc --module esnext --target es2015 --outDir ./es",
    "build:cjs": "tsc --module commonjs --target es5 --outDir ./lib",
    "build:umd": "rollup -c",
    "build": "run-p build:cjs build:esm build:umd",
    "prebuild": "run-s lint clean",
    "prepare": "yarn build",
    "precommit": "lint-staged"
  },
  "lint-staged": {
    "src/**/*.ts": [
      "tslint -c tslint.json -p ./tsconfig.json --fix"
    ]
  },
  "peerDependencies": {
    "@antv/x6": "^0.13.7",
    "react": ">=16.8.6",
    "react-dom": ">=16.8.6"
  },
  "devDependencies": {
    "@rollup/plugin-commonjs": "^15.1.0",
    "@rollup/plugin-node-resolve": "^9.0.0",
    "@rollup/plugin-typescript": "^6.0.0",
    "@types/node": "^13.9.1",
    "@types/react": "^16.9.13",
    "lint-staged": "^10.2.2",
    "npm-run-all": "^4.1.5",
    "react": "^16.12.0",
    "react-dom": "^16.12.0",
    "rimraf": "^3.0.0",
    "rollup": "^2.10.5",
    "rollup-plugin-auto-external": "^2.0.0",
    "rollup-plugin-filesize": "^9.0.0",
    "rollup-plugin-terser"

--- bundled output (OSV-MAL flagged — LLM scope expansion) ---

--- dist/x6-react.js (bundled) ---
!function(n){"function"==typeof define&&define.amd?define(n):n()}((function(){}));
//# sourceMappingURL=x6-react.js.map