All @antv/g-camera-api versions

@antv/[email protected] rejected Risk: 100 No license

@antv/g-camera-api @2.1.45

rejected
This version was rejected. It did not pass GreenFlagged's security review and is not served by the registry. The findings and risk dispositions below explain why.
npm Repository Homepage Tarball
100
Risk Score
—
License
No
Install Scripts
5
Dependencies
0
Dev Dependencies
439.3 KB
Package Size
Published

Maintainers

lviseifreestyle21soundquietelaine.q.10sturubysakuya223serializedowenxdzhaoyangzhanmeiwjgogogoleungwensendoriiaaronyardsimaqdxq613intchoussusan_annjinke.lilzxuearmy8735atoolbaizndengfupingneoddishjeffy2012zqluafc163pomelo-nwukopiluwakyccnuzindexpanyuqibubkoozengyuekasmineboyu.zljl1ud0ngq1newbyvectorwinniexingchenlulikn9117xdddstsemious2020esoranadia_liubbsqqmxz96102openwaynepearminipddpdyiqianyaozhanbacxxxxxnlaixingui.lxgsusiwen8yanxiongzeyuwangrainy25ghzzhangjunjie-lokiflash1yisi.wangdreammy23biupiubiupiubasketduckxuying1027banxuanpearl_wangbqxbqxbqxalex_zjtduxinyue023wang1212leondt1gaofuhong

Keywords

antvgrendering engine

Dependencies (5)

PackageConstraintRegistry Status
tslib ^2.5.3 auto_approved
gl-matrix ^3.4.3 auto_approved
@antv/util ^3.3.5 auto_approved
@antv/g-lite 2.5.1 auto_approved
@babel/runtime ^7.25.6 auto_approved

Transitive Dependency Tree

59 transitive deps max depth 5
  ├─ @antv/g-lite 2.5.1 → 2.5.1
  ├─ @antv/util ^3.3.5 → 3.3.11
  ├─ @babel/runtime ^7.25.6 → 7.29.7
  ├─ gl-matrix ^3.4.3 → 3.4.4
├─ tslib ^2.5.3 → 2.8.1
  ├─ @antv/g-math 3.0.1 → 3.0.1
  ├─ @antv/vendor ^1.0.3 → 1.0.11
  ├─ eventemitter3 ^5.0.1 → 5.0.4
├─ fast-deep-equal ^3.1.3 → 3.1.3
  ├─ @types/d3-array ^3.2.1 → 3.2.2
  ├─ @types/d3-color ^3.1.3 → 3.1.3
  ├─ @types/d3-dispatch ^3.0.6 → 3.0.7
  ├─ @types/d3-dsv ^3.0.7 → 3.0.7
  ├─ @types/d3-ease ^3.0.2 → 3.0.2
  ├─ @types/d3-fetch ^3.0.7 → 3.0.7
  ├─ @types/d3-force ^3.0.10 → 3.0.10
  ├─ @types/d3-format ^3.0.4 → 3.0.4
  ├─ @types/d3-geo ^3.1.0 → 3.1.0
  ├─ @types/d3-hierarchy ^3.1.7 → 3.1.7
  ├─ @types/d3-interpolate ^3.0.4 → 3.0.4
  ├─ @types/d3-path ^3.1.0 → 3.1.1
  ├─ @types/d3-quadtree ^3.0.6 → 3.0.6
  ├─ @types/d3-random ^3.0.3 → 3.0.3
  ├─ @types/d3-scale ^4.0.9 → 4.0.9
  ├─ @types/d3-scale-chromatic ^3.1.0 → 3.1.0
  ├─ @types/d3-shape ^3.1.7 → 3.1.8
  ├─ @types/d3-time ^3.0.4 → 3.0.4
  ├─ @types/d3-timer ^3.0.2 → 3.0.2
  ├─ d3-array ^3.2.4
  ├─ d3-color ^3.1.0 → 3.1.0
  ├─ d3-dispatch ^3.0.1 → 3.0.1
  ├─ d3-dsv ^3.0.1 → 3.0.1
  ├─ d3-ease ^3.0.1 → 3.0.1
  ├─ d3-fetch ^3.0.1 → 3.0.1
  ├─ d3-force ^3.0.0 → 3.0.0
  ├─ d3-force-3d ^3.0.5 → 3.0.6
  ├─ d3-format ^3.1.0 → 3.1.2
  ├─ d3-geo ^3.1.1 → 3.1.1
  ├─ d3-geo-projection ^4.0.0 → 4.0.0
  ├─ d3-hierarchy ^3.1.2 → 3.1.2
  ├─ d3-interpolate ^3.0.1 → 3.0.1
  ├─ d3-path ^3.1.0 → 3.1.0
  ├─ d3-quadtree ^3.0.1 → 3.0.1
  ├─ d3-random ^3.0.1 → 3.0.1
  ├─ d3-regression ^1.3.10 → 1.3.10
  ├─ d3-scale ^4.0.2 → 4.0.2
  ├─ d3-scale-chromatic ^3.1.0 → 3.1.0
  ├─ d3-shape ^3.2.0 → 3.2.0
  ├─ d3-time ^3.1.0 → 3.1.0
├─ d3-timer ^3.0.1 → 3.0.1
  ├─ @types/geojson * → 7946.0.16
  ├─ commander 7 → 7.2.0
  ├─ d3-binarytree 1 → 1.0.2
  ├─ d3-octree 1 → 1.1.0
  ├─ d3-time-format 2 - 4 → 4.1.0
  ├─ iconv-lite 0.6 → 0.6.3
├─ rw 1 → 1.3.3
  ├─ internmap 1 - 2 → 2.0.3
  ├─ safer-buffer >= 2.1.2 < 3.0.0 → 2.1.2

Changes from v2.0.45

Dependency Changes

Script Changes

+ preinstall

File Changes

1 added 0 removed 1 modified size delta: +486.9 KB

Risk Dispositions (0 applicable to this version, 6 other)

Accepted rules are downgraded to INFO on future analyses; rejected rules escalate to CRITICAL.

Show 6 disposition(s) that do not match any finding on this version
Rule Source Disposition Author Reason
install-script:preinstall install-scripts reject AI AI (install-scripts): Preinstall runs obfuscated index.js; malicious payload execution at install time.
obfuscated-file:index.js source-diff reject AI AI (source-diff): Newly added heavily obfuscated file is the malicious payload.
url-dep:@antv/setup npm-metadata reject AI AI (npm-metadata): SHA-pinned GitHub optionalDependency matches known supply-chain attack pattern; bypasses registry.
publisher-changed provenance reject AI AI (provenance): Publisher changed after 1313 days dormancy; strong account takeover indicator.
semgrep:obfuscation-while-true semgrep reject AI AI (semgrep): Obfuscation signature in malicious payload file.
semgrep:env-spread semgrep reject AI AI (semgrep): process.env spread in obfuscated payload — credential harvesting indicator.

Review Summary

Risk score: 100 (capped from 261). Findings: 9 high (+225), 3 medium (+30), 2 low (+6).

Published to npm: