All @antv/g-plugin-canvas-picker versions

@antv/[email protected] rejected Risk: 100 No license 2026-05-19

@antv/g-plugin-canvas-picker @2.4.1

rejected

This version was rejected. It did not pass GreenFlagged's security review and is not served by the registry. The findings and risk dispositions below explain why.

npm Repository Homepage Tarball

100

Risk Score

—

License

Install Scripts

Dependencies

Dev Dependencies

266.0 KB

Package Size

2026-05-19

Published

Maintainers

lviseifreestyle21soundquietelaine.q.10sturubysakuya223serializedowenxdzhaoyangzhanmeiwjgogogoleungwensendoriiaaronyardsimaqdxq613intchoussusan_annjinke.lilzxuearmy8735atoolbaizndengfupingneoddishjeffy2012zqluafc163pomelo-nwukopiluwakyccnuzindexpanyuqibubkoozengyuekasmineboyu.zljl1ud0ngq1newbyvectorwinniexingchenlulikn9117xdddstsemious2020esoranadia_liubbsqqmxz96102openwaynepearminipddpdyiqianyaozhanbacxxxxxnlaixingui.lxgsusiwen8yanxiongzeyuwangrainy25ghzzhangjunjie-lokiflash1yisi.wangdreammy23biupiubiupiubasketduckxuying1027banxuanpearl_wangbqxbqxbqxalex_zjtduxinyue023wang1212leondt1gaofuhong

Keywords

antvg

Dependencies (8)

Package	Constraint	Registry Status
tslib	^2.5.3	auto_approved
gl-matrix	^3.4.3	auto_approved
@antv/util	^3.3.5	auto_approved
@antv/g-lite	2.5.1	auto_approved
@antv/g-math	3.0.1	auto_approved
@babel/runtime	^7.25.6	auto_approved
@antv/g-plugin-canvas-renderer	2.5.1	auto_approved
@antv/g-plugin-canvas-path-generator	2.1.26	auto_approved

Transitive Dependency Tree

62 transitive deps max depth 5

├─ @antv/g-lite 2.5.1 → 2.5.1

├─ @antv/g-math 3.0.1 → 3.0.1

├─ @antv/g-plugin-canvas-path-generator 2.1.26 → 2.1.26

├─ @antv/g-plugin-canvas-renderer 2.5.1 → 2.5.1

├─ @antv/util ^3.3.5 → 3.3.11

├─ @babel/runtime ^7.25.6 → 7.29.7

├─ gl-matrix ^3.4.3 → 3.4.4

├─ tslib ^2.5.3 → 2.8.1

├─ @antv/g-plugin-image-loader 2.3.1 → 2.3.1

├─ @antv/vendor ^1.0.3 → 1.0.11

├─ eventemitter3 ^5.0.1 → 5.0.4

├─ fast-deep-equal ^3.1.3 → 3.1.3

├─ @types/d3-array ^3.2.1 → 3.2.2

├─ @types/d3-color ^3.1.3 → 3.1.3

├─ @types/d3-dispatch ^3.0.6 → 3.0.7

├─ @types/d3-dsv ^3.0.7 → 3.0.7

├─ @types/d3-ease ^3.0.2 → 3.0.2

├─ @types/d3-fetch ^3.0.7 → 3.0.7

├─ @types/d3-force ^3.0.10 → 3.0.10

├─ @types/d3-format ^3.0.4 → 3.0.4

├─ @types/d3-geo ^3.1.0 → 3.1.0

├─ @types/d3-hierarchy ^3.1.7 → 3.1.7

├─ @types/d3-interpolate ^3.0.4 → 3.0.4

├─ @types/d3-path ^3.1.0 → 3.1.1

├─ @types/d3-quadtree ^3.0.6 → 3.0.6

├─ @types/d3-random ^3.0.3 → 3.0.3

├─ @types/d3-scale ^4.0.9 → 4.0.9

├─ @types/d3-scale-chromatic ^3.1.0 → 3.1.0

├─ @types/d3-shape ^3.1.7 → 3.1.8

├─ @types/d3-time ^3.0.4 → 3.0.4

├─ @types/d3-timer ^3.0.2 → 3.0.2

├─ d3-array ^3.2.4

├─ d3-color ^3.1.0 → 3.1.0

├─ d3-dispatch ^3.0.1 → 3.0.1

├─ d3-dsv ^3.0.1 → 3.0.1

├─ d3-ease ^3.0.1 → 3.0.1

├─ d3-fetch ^3.0.1 → 3.0.1

├─ d3-force ^3.0.0 → 3.0.0

├─ d3-force-3d ^3.0.5 → 3.0.6

├─ d3-format ^3.1.0 → 3.1.2

├─ d3-geo ^3.1.1 → 3.1.1

├─ d3-geo-projection ^4.0.0 → 4.0.0

├─ d3-hierarchy ^3.1.2 → 3.1.2

├─ d3-interpolate ^3.0.1 → 3.0.1

├─ d3-path ^3.1.0 → 3.1.0

├─ d3-quadtree ^3.0.1 → 3.0.1

├─ d3-random ^3.0.1 → 3.0.1

├─ d3-regression ^1.3.10 → 1.3.10

├─ d3-scale ^4.0.2 → 4.0.2

├─ d3-scale-chromatic ^3.1.0 → 3.1.0

├─ d3-shape ^3.2.0 → 3.2.0

├─ d3-time ^3.1.0 → 3.1.0

├─ d3-timer ^3.0.1 → 3.0.1

├─ @types/geojson * → 7946.0.16

├─ commander 7 → 7.2.0

├─ d3-binarytree 1 → 1.0.2

├─ d3-octree 1 → 1.1.0

├─ d3-time-format 2 - 4 → 4.1.0

├─ iconv-lite 0.6 → 0.6.3

├─ rw 1 → 1.3.3

├─ internmap 1 - 2 → 2.0.3

├─ safer-buffer >= 2.1.2 < 3.0.0 → 2.1.2

Changes from v2.3.1

Dependency Changes

Script Changes

+ preinstall

File Changes

1 added 0 removed 1 modified size delta: +486.9 KB

Risk Dispositions (0 applicable to this version, 6 other)

Accepted rules are downgraded to INFO on future analyses; rejected rules escalate to CRITICAL.

Show 6 disposition(s) that do not match any finding on this version

Rule	Source	Disposition	Author	Reason
`install-script:preinstall`	install-scripts	reject	AI	AI (install-scripts): Preinstall executes obfuscated malware payload; not a legitimate build step for this package.
`obfuscated-file:index.js`	source-diff	reject	AI	AI (source-diff): Obfuscated 498KB index.js is a malicious payload, not legitimate source.
`semgrep:obfuscation-while-true`	semgrep	reject	AI	AI (semgrep): Obfuscation signature in malicious payload; generalizes as disqualifier.
`semgrep:env-spread`	semgrep	reject	AI	AI (semgrep): process.env spread in obfuscated payload indicates credential exfiltration.
`url-dep:@antv/setup`	npm-metadata	reject	AI	AI (npm-metadata): SHA-pinned GitHub optionalDep matches known supply-chain attack pattern; disqualifier for this package.
`publisher-changed`	provenance	reject	AI	AI (provenance): Publisher change to atool coincides with malicious payload injection; account takeover indicator.

Review Summary

Risk score: 100 (capped from 258). Findings: 9 high (+225), 3 medium (+30), 1 low (+3), 3 info (+0).

Commit: 89a517f161e7 Browse source

Published to npm: 2026-05-19