// npm package

@antv/x6-vector

Lightweight library for manipulating and animating SVG.

npmjs.com tarball repo homepage

versions

maintainers

license

MIT

first publish

2021-03-23

publisher

newbyvector

tarball

5,934,785 B

AUTO-PUBLISHED·1 version indexed·latest published 2022-10-13

// publisher campaignby newbyvector

9 caught packages from this account

This is not an isolated catch. The same publisher has shipped 8 other packages that our pipeline flagged — the shape of a coordinated campaign, not a one-off. Each link below opens that sibling's analysis.

// offending code· @1.4.2· 1 file flagged

llm: benign · 0.85

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@1.4.2·2022-10-13·AUTO-PUBLISHED·publisher: newbyvector

heuristic 75/100

static flags 1

llm benign (0.85) via ollama

mature-packageosv-flagged:MAL-2026-4115public-github-push

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

// offending code· 1 file flaggedpatterns: 1

--- install scripts ---
### prepare
run-s test build



--- package/package.json (excerpt) ---
{
  "version": "1.4.2",
  "name": "@antv/x6-vector",
  "description": "Lightweight library for manipulating and animating SVG.",
  "main": "lib/index.js",
  "module": "es/index.js",
  "unpkg": "dist/x6-vector.js",
  "jsdelivr": "dist/x6-vector.js",
  "types": "lib/index.d.ts",
  "files": [
    "dist",
    "es",
    "lib"
  ],
  "keywords": [
    "vector",
    "svg",
    "x6",
    "antv"
  ],
  "scripts": {
    "clean:build": "rimraf dist es lib",
    "clean:coverage": "rimraf ./test/coverage",
    "clean": "run-p clean:build clean:coverage",
    "lint": "eslint 'src/**/*.{js,ts}?(x)' --fix",
    "build:esm": "tsc --module esnext --target es2015 --outDir ./es",
    "build:cjs": "tsc --module commonjs --target es5 --outDir ./lib",
    "build:umd": "rollup -c",
    "build:csstype": "node ./scripts/csstype.js",
    "build:watch": "yarn build:esm --w",
    "build:watch:esm": "yarn build:esm --w",
    "build:watch:cjs": "yarn build:cjs --w",
    "build:dev": "run-p build:csstype build:cjs build:esm",
    "build": "run-p build:dev build:umd",
    "prebuild": "run-s lint clean",
    "test": "karma start",
    "test:watch": "karma start --single-run=false --auto-watch",
    "test:debug": "karma start --browsers=Chrome --single-run=false --auto-watch --debug",
    "coveralls": "cat ./test/coverage/lcov.info | coveralls",
    "pretest": "run-p clean:coverage",
    "prepare": "run-s test build",
    "precommit": "lint-staged"
  },
  "lint-staged": {
    "src/**/*.ts": [
      "eslint --f