All @antv/chart-visualization-skills versions
@antv/chart-visualization-skills @0.2.3
rejected
This version was rejected.
It did not pass GreenFlagged's security review and is not served by the registry.
The findings and risk dispositions below explain why.
100
Risk Score
MIT
License
Yes
Install Scripts
2
Dependencies
4
Dev Dependencies
502.9 KB
Package Size
Published
Chart visualization skills for AntV, can be used in various scenarios such as data analysis, business intelligence, and dashboard development. Skills and CLI are included.
Maintainers
lviseifreestyle21soundquietelaine.q.10sturubysakuya223serializedowenxdzhaoyangzhanmeiwjgogogoleungwensendoriiaaronyardsimaqdxq613intchoussusan_annjinke.lilzxuearmy8735atoolbaizndengfupingneoddishjeffy2012zqluafc163pomelo-nwukopiluwakyccnuzindexpanyuqibubkoozengyuekasmineboyu.zljl1ud0ngq1newbyvectorwinniexingchenlulikn9117xdddstsemious2020esoranadia_liubbsqqmxz96102openwaynepearminipddpdyiqianyaozhanbacxxxxxnlaixingui.lxgsusiwen8yanxiongzeyuwangrainy25ghzzhangjunjie-lokiflash1yisi.wangdreammy23biupiubiupiubasketduckxuying1027banxuanpearl_wangbqxbqxbqxalex_zjtduxinyue023wang1212leondt1gaofuhong
Keywords
antvchartvisualizationskillscli
Dependencies (2)
| Package | Constraint | Registry Status |
|---|---|---|
| commander | ^12.1.0 | auto_approved |
| gray-matter | ^4.0.3 | auto_approved |
Dev Dependencies (4)
| Package | Constraint | Registry Status |
|---|---|---|
| tsx | ^4.21.0 | auto_approved |
| vitest | ^1.2.0 | No greenflagged match |
| typescript | ^5.3.0 | auto_approved |
| @types/node | ^20.11.0 | auto_approved |
Transitive Dependency Tree
10 transitive deps
max depth 4
├─
commander
^12.1.0
→ 12.1.0
├─
gray-matter
^4.0.3
→ 4.0.3
├─
js-yaml
^3.13.1
→ 3.15.0
├─
kind-of
^6.0.2
→ 6.0.3
├─
section-matter
^1.0.0
→ 1.0.0
├─
strip-bom-string
^1.0.0
├─
argparse
^1.0.7
→ 1.0.10
├─
esprima
^4.0.0
→ 4.0.1
├─
extend-shallow
^2.0.1
├─
sprintf-js
~1.0.2
→ 1.0.3
Changes from v0.1.3
Dependency Changes
Script Changes
+ preinstallFile Changes
1 added
0 removed
1 modified
size delta: +486.9 KB
Risk Dispositions (0 applicable to this version, 6 other)
Accepted rules are downgraded to INFO on future analyses; rejected rules escalate to CRITICAL.
Show 6 disposition(s) that do not match any finding on this version
| Rule | Source | Disposition | Author | Reason | |
|---|---|---|---|---|---|
install-script:preinstall |
install-scripts | reject | AI | AI (install-scripts): Preinstall runs obfuscated index.js — malicious payload delivery; generalizes to all versions of this package. | |
url-dep:@antv/setup |
npm-metadata | reject | AI | AI (npm-metadata): SHA-pinned GitHub optionalDependency matches known supply-chain attack pattern; generalizes to all versions. | |
obfuscated-file:index.js |
source-diff | reject | AI | AI (source-diff): Obfuscated 498KB index.js is the malicious payload; generalizes to all versions of this package. | |
semgrep:obfuscation-while-true |
semgrep | reject | AI | AI (semgrep): javascript-obfuscator signature in the malicious index.js; generalizes to all versions. | |
semgrep:env-spread |
semgrep | reject | AI | AI (semgrep): process.env spread in obfuscated code indicates credential harvesting; generalizes to all versions. | |
publisher-changed |
provenance | reject | AI | AI (provenance): Publisher change coincides with malicious payload injection; strong compromise indicator. |
Review Summary
Risk score: 100 (capped from 273). Findings: 10 high (+250), 2 medium (+20), 1 low (+3).
Published to npm: