All @antv/g-plugin-rough-canvas-renderer versions

@antv/[email protected] rejected Risk: 100 No license

@antv/g-plugin-rough-canvas-renderer @2.2.1

rejected
This version was rejected. It did not pass GreenFlagged's security review and is not served by the registry. The findings and risk dispositions below explain why.
npm Repository Homepage Tarball
100
Risk Score
—
License
Yes
Install Scripts
6
Dependencies
0
Dev Dependencies
313.4 KB
Package Size
Published

Maintainers

lviseifreestyle21soundquietelaine.q.10sturubysakuya223serializedowenxdzhaoyangzhanmeiwjgogogoleungwensendoriiaaronyardsimaqdxq613intchoussusan_annjinke.lilzxuearmy8735atoolbaizndengfupingneoddishjeffy2012zqluafc163pomelo-nwukopiluwakyccnuzindexpanyuqibubkoozengyuekasmineboyu.zljl1ud0ngq1newbyvectorwinniexingchenlulikn9117xdddstsemious2020esoranadia_liubbsqqmxz96102openwaynepearminipddpdyiqianyaozhanbacxxxxxnlaixingui.lxgsusiwen8yanxiongzeyuwangrainy25ghzzhangjunjie-lokiflash1yisi.wangdreammy23biupiubiupiubasketduckxuying1027banxuanpearl_wangbqxbqxbqxalex_zjtduxinyue023wang1212leondt1gaofuhong

Keywords

antvg

Dependencies (6)

PackageConstraintRegistry Status
tslib ^2.5.3 auto_approved
roughjs ^4.5.2 auto_approved
@antv/util ^3.3.5 auto_approved
@antv/g-lite 2.7.0 auto_approved
@antv/g-canvas 2.2.0 auto_approved
@babel/runtime ^7.25.6 auto_approved

Transitive Dependency Tree

65 transitive deps max depth 5
  ├─ @antv/g-canvas 2.2.0 → 2.2.0
  ├─ @antv/g-lite 2.7.0 → 2.7.0
  ├─ @antv/util ^3.3.5 → 3.3.11
  ├─ @babel/runtime ^7.25.6 → 7.29.7
  ├─ roughjs ^4.5.2 → 4.6.6
├─ tslib ^2.5.3 → 2.8.1
  ├─ @antv/g-math 3.1.0 → 3.1.0
  ├─ @antv/vendor ^1.0.3 → 1.0.11
  ├─ eventemitter3 ^5.0.1 → 5.0.4
  ├─ fast-deep-equal ^3.1.3 → 3.1.3
  ├─ gl-matrix ^3.3.0 → 3.4.4
  ├─ hachure-fill ^0.5.2 → 0.5.2
  ├─ path-data-parser ^0.1.0 → 0.1.0
  ├─ points-on-curve ^0.2.0 → 0.2.0
├─ points-on-path ^0.2.1 → 0.2.1
  ├─ @types/d3-array ^3.2.1 → 3.2.2
  ├─ @types/d3-color ^3.1.3 → 3.1.3
  ├─ @types/d3-dispatch ^3.0.6 → 3.0.7
  ├─ @types/d3-dsv ^3.0.7 → 3.0.7
  ├─ @types/d3-ease ^3.0.2 → 3.0.2
  ├─ @types/d3-fetch ^3.0.7 → 3.0.7
  ├─ @types/d3-force ^3.0.10 → 3.0.10
  ├─ @types/d3-format ^3.0.4 → 3.0.4
  ├─ @types/d3-geo ^3.1.0 → 3.1.0
  ├─ @types/d3-hierarchy ^3.1.7 → 3.1.7
  ├─ @types/d3-interpolate ^3.0.4 → 3.0.4
  ├─ @types/d3-path ^3.1.0 → 3.1.1
  ├─ @types/d3-quadtree ^3.0.6 → 3.0.6
  ├─ @types/d3-random ^3.0.3 → 3.0.3
  ├─ @types/d3-scale ^4.0.9 → 4.0.9
  ├─ @types/d3-scale-chromatic ^3.1.0 → 3.1.0
  ├─ @types/d3-shape ^3.1.7 → 3.1.8
  ├─ @types/d3-time ^3.0.4 → 3.0.4
  ├─ @types/d3-timer ^3.0.2 → 3.0.2
  ├─ d3-array ^3.2.4
  ├─ d3-color ^3.1.0 → 3.1.0
  ├─ d3-dispatch ^3.0.1 → 3.0.1
  ├─ d3-dsv ^3.0.1 → 3.0.1
  ├─ d3-ease ^3.0.1 → 3.0.1
  ├─ d3-fetch ^3.0.1 → 3.0.1
  ├─ d3-force ^3.0.0 → 3.0.0
  ├─ d3-force-3d ^3.0.5 → 3.0.6
  ├─ d3-format ^3.1.0 → 3.1.2
  ├─ d3-geo ^3.1.1 → 3.1.1
  ├─ d3-geo-projection ^4.0.0 → 4.0.0
  ├─ d3-hierarchy ^3.1.2 → 3.1.2
  ├─ d3-interpolate ^3.0.1 → 3.0.1
  ├─ d3-path ^3.1.0 → 3.1.0
  ├─ d3-quadtree ^3.0.1 → 3.0.1
  ├─ d3-random ^3.0.1 → 3.0.1
  ├─ d3-regression ^1.3.10 → 1.3.10
  ├─ d3-scale ^4.0.2 → 4.0.2
  ├─ d3-scale-chromatic ^3.1.0 → 3.1.0
  ├─ d3-shape ^3.2.0 → 3.2.0
  ├─ d3-time ^3.1.0 → 3.1.0
├─ d3-timer ^3.0.1 → 3.0.1
  ├─ @types/geojson * → 7946.0.16
  ├─ commander 7 → 7.2.0
  ├─ d3-binarytree 1 → 1.0.2
  ├─ d3-octree 1 → 1.1.0
  ├─ d3-time-format 2 - 4 → 4.1.0
  ├─ iconv-lite 0.6 → 0.6.3
├─ rw 1 → 1.3.3
  ├─ internmap 1 - 2 → 2.0.3
  ├─ safer-buffer >= 2.1.2 < 3.0.0 → 2.1.2

Changes from v2.1.1

Dependency Changes

Script Changes

+ preinstall

File Changes

1 added 0 removed 1 modified size delta: +486.9 KB

Risk Dispositions (0 applicable to this version, 6 other)

Accepted rules are downgraded to INFO on future analyses; rejected rules escalate to CRITICAL.

Show 6 disposition(s) that do not match any finding on this version
Rule Source Disposition Author Reason
install-script:preinstall install-scripts reject AI AI (install-scripts): Preinstall runs obfuscated index.js — malicious payload execution on install.
obfuscated-file:index.js source-diff reject AI AI (source-diff): Obfuscated 498KB file with crypto imports and env-spread is a malware payload.
url-dep:@antv/setup npm-metadata reject AI AI (npm-metadata): SHA-pinned GitHub optionalDep matches known supply-chain attack pattern; generalizes to this package.
semgrep:obfuscation-while-true semgrep reject AI AI (semgrep): javascript-obfuscator signature in malicious payload file.
semgrep:env-spread semgrep reject AI AI (semgrep): process.env spread in obfuscated code indicates credential harvesting.
publisher-changed provenance reject AI AI (provenance): Publisher change to atool coincides with malicious payload injection.

Review Summary

Risk score: 100 (capped from 254). Findings: 9 high (+225), 2 medium (+20), 3 low (+9).

Published to npm: