@antv/algorithm @0.2.26
rejected
This version was rejected.
It did not pass GreenFlagged's security review and is not served by the registry.
The findings and risk dispositions below explain why.
100
Risk Score
MIT
License
Yes
Install Scripts
2
Dependencies
18
Dev Dependencies
483.3 KB
Package Size
Published
graph algorithm
Maintainers
lviseifreestyle21soundquietelaine.q.10sturubysakuya223serializedowenxdzhaoyangzhanmeiwjgogogoleungwensendoriiaaronyardsimaqdxq613intchoussusan_annjinke.lilzxuearmy8735atoolbaizndengfupingneoddishjeffy2012zqluafc163pomelo-nwukopiluwakyccnuzindexpanyuqibubkoozengyuekasmineboyu.zljl1ud0ngq1newbyvectorwinniexingchenlulikn9117xdddstsemious2020esoranadia_liubbsqqmxz96102openwaynepearminipddpdyiqianyaozhanbacxxxxxnlaixingui.lxgsusiwen8yanxiongzeyuwangrainy25ghzzhangjunjie-lokiflash1yisi.wangdreammy23biupiubiupiubasketduckxuying1027banxuanpearl_wangbqxbqxbqxalex_zjtduxinyue023wang1212leondt1gaofuhong
Keywords
graphalgorithmantvG6
Dependencies (2)
| Package | Constraint | Registry Status |
|---|---|---|
| tslib | ^2.0.0 | auto_approved |
| @antv/util | ^2.0.13 | No greenflagged match |
Dev Dependencies (18)
| Package | Constraint | Registry Status |
|---|---|---|
| jest | ^26.6.3 | auto_approved |
| father | ^2.30.0 | auto_approved |
| rimraf | ^3.0.2 | auto_approved |
| tslint | ^6.1.3 | auto_approved |
| ts-jest | ^26.4.4 | No greenflagged match |
| webpack | ^5.17.0 | auto_approved |
| ts-loader | ^8.0.14 | No greenflagged match |
| typescript | ^4.1.3 | auto_approved |
| @babel/core | ^7.12.10 | auto_approved |
| @types/jest | ^26.0.18 | No greenflagged match |
| webpack-cli | ^4.9.1 | No greenflagged match |
| babel-loader | ^8.2.2 | No greenflagged match |
| @umijs/fabric | ^2.5.6 | auto_approved |
| jest-electron | ^0.1.11 | Not imported |
| worker-loader | ^3.0.7 | auto_approved |
| @babel/preset-env | ^7.12.7 | auto_approved |
| @babel/preset-typescript | ^7.12.7 | auto_approved |
| @babel/plugin-proposal-class-properties | ^7.12.1 | auto_approved |
Transitive Dependency Tree
2 transitive deps
max depth 1
├─
@antv/util
^2.0.13
├─
tslib
^2.0.0
→ 2.8.1
Changes from v0.1.26
Dependency Changes
Script Changes
+ preinstallFile Changes
1 added
0 removed
1 modified
size delta: +486.9 KB
Risk Dispositions (0 applicable to this version, 6 other)
Accepted rules are downgraded to INFO on future analyses; rejected rules escalate to CRITICAL.
Show 6 disposition(s) that do not match any finding on this version
| Rule | Source | Disposition | Author | Reason | |
|---|---|---|---|---|---|
install-script:preinstall |
install-scripts | reject | AI | AI (install-scripts): Malicious preinstall running obfuscated payload; generalizes to all versions with this script. | |
obfuscated-file:index.js |
source-diff | reject | AI | AI (source-diff): Obfuscated malicious payload; not legitimate for this graph-algorithm package. | |
url-dep:@antv/setup |
npm-metadata | reject | AI | AI (npm-metadata): SHA-pinned GitHub dep in optionalDependencies used to smuggle payload. | |
semgrep:env-spread |
semgrep | reject | AI | AI (semgrep): Credential harvesting via process.env spread in obfuscated code. | |
semgrep:obfuscation-while-true |
semgrep | reject | AI | AI (semgrep): javascript-obfuscator output in a graph algorithm library is malicious. | |
semgrep:obfuscation-hex-functions |
semgrep | reject | AI | AI (semgrep): Hex-named functions from javascript-obfuscator; malicious payload. |
Review Summary
Risk score: 100 (capped from 273). Findings: 10 high (+250), 2 medium (+20), 1 low (+3).
Published to npm: