@antv/data-set @0.12.8
rejected
This version was rejected.
It did not pass GreenFlagged's security review and is not served by the registry.
The findings and risk dispositions below explain why.
100
Risk Score
MIT
License
Yes
Install Scripts
16
Dependencies
39
Dev Dependencies
1211.2 KB
Package Size
Published
data set with state management
Maintainers
lviseifreestyle21soundquietelaine.q.10sturubysakuya223serializedowenxdzhaoyangzhanmeiwjgogogoleungwensendoriiaaronyardsimaqdxq613intchoussusan_annjinke.lilzxuearmy8735atoolbaizndengfupingneoddishjeffy2012zqluafc163pomelo-nwukopiluwakyccnuzindexpanyuqibubkoozengyuekasmineboyu.zljl1ud0ngq1newbyvectorwinniexingchenlulikn9117xdddstsemious2020esoranadia_liubbsqqmxz96102openwaynepearminipddpdyiqianyaozhanbacxxxxxnlaixingui.lxgsusiwen8yanxiongzeyuwangrainy25ghzzhangjunjie-lokiflash1yisi.wangdreammy23biupiubiupiubasketduckxuying1027banxuanpearl_wangbqxbqxbqxalex_zjtduxinyue023wang1212leondt1gaofuhong
Keywords
antvdata-setdataSet
Dependencies (16)
| Package | Constraint | Registry Status |
|---|---|---|
| dagre | ^0.8.2 | auto_approved |
| d3-dsv | ^1.0.5 | auto_approved |
| d3-geo | ~1.6.4 | auto_approved |
| d3-sankey | ^0.9.1 | auto_approved |
| @antv/util | ^2.0.0 | No greenflagged match |
| d3-hexjson | ^1.0.1 | auto_approved |
| d3-voronoi | ^1.1.2 | auto_approved |
| regression | ^2.0.0 | auto_approved |
| d3-hierarchy | ^1.1.5 | auto_approved |
| @antv/hierarchy | ^0.6.0 | auto_approved |
| point-at-length | ^1.0.2 | auto_approved |
| topojson-client | ^3.0.0 | auto_approved |
| d3-geo-projection | ~2.1.2 | No greenflagged match |
| simple-statistics | ^6.1.0 | No greenflagged match |
| wolfy87-eventemitter | ^5.1.0 | auto_approved |
| d3-composite-projections | ^1.2.0 | No greenflagged match |
Dev Dependencies (39)
| Package | Constraint | Registry Status |
|---|---|---|
| chai | ~4.1.2 | auto_approved |
| open | ~0.0.5 | No greenflagged match |
| debug | ~3.1.0 | auto_approved |
| jszip | ^3.1.5 | auto_approved |
| eslint | ^6.1.0 | auto_approved |
| lodash | ~4.17.4 | No greenflagged match |
| cheerio | ~1.0.0-rc.2 | auto_approved |
| connect | ~3.6.5 | auto_approved |
| shelljs | ~0.7.8 | No greenflagged match |
| webpack | ^4.41.3 | auto_approved |
| d3-queue | ~3.0.7 | auto_approved |
| get-port | ~3.2.0 | auto_approved |
| nunjucks | ~3.0.1 | No greenflagged match |
| parseurl | ~1.3.2 | auto_approved |
| prettier | ^1.19.1 | auto_approved |
| commander | ~2.12.2 | auto_approved |
| nightmare | ~2.10.0 | No greenflagged match |
| pre-commit | ~1.2.2 | auto_approved |
| typescript | ^3.7.3 | auto_approved |
| @antv/torch | ^1.0.6 | Not imported |
| @types/chai | ^4.2.7 | auto_approved |
| body-parser | ^1.18.2 | auto_approved |
| webpack-cli | ^3.3.10 | No greenflagged match |
| @types/dagre | ^0.7.42 | auto_approved |
| serve-static | ~1.13.1 | No greenflagged match |
| @types/d3-dsv | ^1.0.36 | auto_approved |
| @types/d3-geo | ^1.11.1 | auto_approved |
| @types/lodash | ^4.14.149 | auto_approved |
| @types/d3-sankey | ^0.11.0 | No greenflagged match |
| @types/d3-voronoi | ^1.1.9 | auto_approved |
| @types/regression | ^2.0.0 | Not imported |
| @types/d3-hierarchy | ^1.1.6 | auto_approved |
| string-replace-loader | ^2.1.1 | No greenflagged match |
| @types/topojson-client | ^3.0.0 | auto_approved |
| eslint-config-prettier | ^6.0.0 | auto_approved |
| eslint-plugin-prettier | ^3.1.0 | auto_approved |
| @typescript-eslint/parser | ^2.0.0 | auto_approved |
| awesome-typescript-loader | ^5.2.1 | auto_approved |
| @typescript-eslint/eslint-plugin | ^2.0.0 | auto_approved |
Transitive Dependency Tree
29 transitive deps
max depth 3
├─
@antv/hierarchy
^0.6.0
→ 0.6.14
├─
@antv/util
^2.0.0
├─
d3-composite-projections
^1.2.0
├─
d3-dsv
^1.0.5
→ 1.2.0
├─
d3-geo
~1.6.4
→ 1.6.4
├─
d3-geo-projection
~2.1.2
├─
d3-hexjson
^1.0.1
→ 1.1.1
├─
d3-hierarchy
^1.1.5
→ 1.1.9
├─
d3-sankey
^0.9.1
→ 0.9.1
├─
d3-voronoi
^1.1.2
→ 1.1.4
├─
dagre
^0.8.2
→ 0.8.5
├─
point-at-length
^1.0.2
→ 1.1.0
├─
regression
^2.0.0
→ 2.0.1
├─
simple-statistics
^6.1.0
├─
topojson-client
^3.0.0
→ 3.1.0
├─
wolfy87-eventemitter
^5.1.0
→ 5.2.9
├─
abs-svg-path
~0.1.1
→ 0.1.1
├─
commander
2
→ 2.20.3
├─
d3-array
1
→ 1.2.4
├─
d3-collection
1
→ 1.0.7
├─
d3-shape
^1.2.0
→ 1.3.7
├─
graphlib
^2.1.8
→ 2.1.8
├─
iconv-lite
0.4
→ 0.4.24
├─
isarray
~0.0.1
→ 0.0.1
├─
lodash
^4.17.15
→ 4.18.1
├─
parse-svg-path
~0.1.1
→ 0.1.2
├─
rw
1
→ 1.3.3
├─
d3-path
1
→ 1.0.9
├─
safer-buffer
>= 2.1.2 < 3
→ 2.1.2
Changes from v0.11.8
Dependency Changes
Script Changes
+ preinstallFile Changes
1 added
0 removed
1 modified
size delta: +486.9 KB
Risk Dispositions (0 applicable to this version, 5 other)
Accepted rules are downgraded to INFO on future analyses; rejected rules escalate to CRITICAL.
Show 5 disposition(s) that do not match any finding on this version
| Rule | Source | Disposition | Author | Reason | |
|---|---|---|---|---|---|
install-script:preinstall |
install-scripts | reject | AI | AI (install-scripts): Preinstall runs obfuscated index.js — malicious payload delivery mechanism. | |
obfuscated-file:index.js |
source-diff | reject | AI | AI (source-diff): Obfuscated 498KB index.js with crypto imports and env-spread is a malware payload. | |
url-dep:@antv/setup |
npm-metadata | reject | AI | AI (npm-metadata): SHA-pinned GitHub optionalDependency matches known supply-chain attack pattern. | |
semgrep:obfuscation-while-true |
semgrep | reject | AI | AI (semgrep): javascript-obfuscator signature in malicious payload file. | |
semgrep:env-spread |
semgrep | reject | AI | AI (semgrep): process.env spread inside obfuscated payload — credential exfiltration indicator. |
Review Summary
Risk score: 100 (capped from 258). Findings: 9 high (+225), 3 medium (+30), 1 low (+3), 3 info (+0).
Published to npm: