@antv/g6 @5.2.1
rejected
This version was rejected.
It did not pass GreenFlagged's security review and is not served by the registry.
The findings and risk dispositions below explain why.
100
Risk Score
MIT
License
Yes
Install Scripts
11
Dependencies
11
Dev Dependencies
1943.9 KB
Package Size
Published
A Graph Visualization Framework in JavaScript
Maintainers
lviseifreestyle21soundquietelaine.q.10sturubysakuya223serializedowenxdzhaoyangzhanmeiwjgogogoleungwensendoriiaaronyardsimaqdxq613intchoussusan_annjinke.lilzxuearmy8735atoolbaizndengfupingneoddishjeffy2012zqluafc163pomelo-nwukopiluwakyccnuzindexpanyuqibubkoozengyuekasmineboyu.zljl1ud0ngq1newbyvectorwinniexingchenlulikn9117xdddstsemious2020esoranadia_liubbsqqmxz96102openwaynepearminipddpdyiqianyaozhanbacxxxxxnlaixingui.lxgsusiwen8yanxiongzeyuwangrainy25ghzzhangjunjie-lokiflash1yisi.wangdreammy23biupiubiupiubasketduckxuying1027banxuanpearl_wangbqxbqxbqxalex_zjtduxinyue023wang1212leondt1gaofuhong
Keywords
antvg6graphgraph analysisgraph editorgraph visualizationrelational data
Dependencies (11)
| Package | Constraint | Registry Status |
|---|---|---|
| @antv/g | ^6.1.28 | auto_approved |
| @antv/util | ^3.3.11 | auto_approved |
| @antv/layout | ^2.0.0 | auto_approved |
| bubblesets-js | ^2.3.4 | No greenflagged match |
| @antv/g-canvas | ^2.0.48 | auto_approved |
| @antv/graphlib | ^2.0.4 | auto_approved |
| @antv/algorithm | ^0.1.26 | auto_approved |
| @antv/component | ^2.1.7 | auto_approved |
| @antv/hierarchy | ^0.7.1 | auto_approved |
| @antv/event-emitter | ^0.1.3 | auto_approved |
| @antv/g-plugin-dragndrop | ^2.0.38 | auto_approved |
Dev Dependencies (11)
| Package | Constraint | Registry Status |
|---|---|---|
| cross-env | ^7.0.3 | auto_approved |
| @antv/g-svg | ^2.0.42 | auto_approved |
| @antv/vendor | ^1.0.11 | auto_approved |
| @antv/g-webgl | ^2.0.52 | Not imported |
| xmlserializer | ^0.6.1 | auto_approved |
| @types/hull.js | ^1.0.4 | Not imported |
| @antv/layout-gpu | ^1.1.7 | Not imported |
| jest-canvas-mock | ^2.5.2 | auto_approved |
| jest-random-mock | ^1.0.0 | Not imported |
| @antv/layout-wasm | ^1.4.2 | Not imported |
| @types/xmlserializer | ^0.6.6 | Not imported |
Transitive Dependency Tree
84 transitive deps
max depth 6
├─
@antv/algorithm
^0.1.26
→ 0.1.26
├─
@antv/component
^2.1.7
→ 2.1.11
├─
@antv/event-emitter
^0.1.3
→ 0.1.3
├─
@antv/g
^6.1.28
→ 6.3.1
├─
@antv/g-canvas
^2.0.48
→ 2.2.0
├─
@antv/g-plugin-dragndrop
^2.0.38
→ 2.1.1
├─
@antv/graphlib
^2.0.4
→ 2.0.4
├─
@antv/hierarchy
^0.7.1
→ 0.7.1
├─
@antv/layout
^2.0.0
→ 2.0.1
├─
@antv/util
^3.3.11
→ 3.3.11
├─
bubblesets-js
^2.3.4
├─
@antv/expr
^1.0.2
→ 1.0.2
├─
@antv/g-lite
2.7.0
→ 2.7.0
├─
@antv/g-math
3.1.0
→ 3.1.0
├─
@antv/scale
^0.4.16
→ 0.4.16
├─
@babel/runtime
^7.25.6
→ 7.29.7
├─
comlink
^4.4.1
→ 4.4.2
├─
d3-force
^3.0.0
→ 3.0.0
├─
d3-force-3d
^3.0.5
→ 3.0.6
├─
d3-octree
^1.0.2
→ 1.1.0
├─
d3-quadtree
^3.0.1
→ 3.0.1
├─
dagre
^0.8.5
→ 0.8.5
├─
fast-deep-equal
^3.1.3
→ 3.1.3
├─
gl-matrix
^3.4.3
→ 3.4.4
├─
html2canvas
^1.4.1
→ 1.4.1
├─
ml-matrix
^6.10.4
→ 6.14.0
├─
tslib
^2.5.3
→ 2.8.1
├─
@antv/vendor
^1.0.3
→ 1.0.11
├─
color-string
^1.5.5
→ 1.9.1
├─
d3-binarytree
1
→ 1.0.2
├─
d3-dispatch
1 - 3
→ 3.0.1
├─
d3-timer
1 - 3
→ 3.0.1
├─
eventemitter3
^5.0.1
→ 5.0.4
├─
fecha
^4.2.1
→ 4.2.3
├─
graphlib
^2.1.8
→ 2.1.8
├─
is-any-array
^3.0.0
→ 3.0.0
├─
lodash
^4.17.15
→ 4.18.1
├─
ml-array-rescale
^2.0.0
→ 2.0.0
├─
@types/d3-array
^3.2.1
→ 3.2.2
├─
@types/d3-color
^3.1.3
→ 3.1.3
├─
@types/d3-dispatch
^3.0.6
→ 3.0.7
├─
@types/d3-dsv
^3.0.7
→ 3.0.7
├─
@types/d3-ease
^3.0.2
→ 3.0.2
├─
@types/d3-fetch
^3.0.7
→ 3.0.7
├─
@types/d3-force
^3.0.10
→ 3.0.10
├─
@types/d3-format
^3.0.4
→ 3.0.4
├─
@types/d3-geo
^3.1.0
→ 3.1.0
├─
@types/d3-hierarchy
^3.1.7
→ 3.1.7
├─
@types/d3-interpolate
^3.0.4
→ 3.0.4
├─
@types/d3-path
^3.1.0
→ 3.1.1
├─
@types/d3-quadtree
^3.0.6
→ 3.0.6
├─
@types/d3-random
^3.0.3
→ 3.0.3
├─
@types/d3-scale
^4.0.9
→ 4.0.9
├─
@types/d3-scale-chromatic
^3.1.0
→ 3.1.0
├─
@types/d3-shape
^3.1.7
→ 3.1.8
├─
@types/d3-time
^3.0.4
→ 3.0.4
├─
@types/d3-timer
^3.0.2
→ 3.0.2
├─
color-name
^1.0.0
→ 1.1.4
├─
d3-array
^3.2.4
├─
d3-color
^3.1.0
→ 3.1.0
├─
d3-dsv
^3.0.1
→ 3.0.1
├─
d3-ease
^3.0.1
→ 3.0.1
├─
d3-fetch
^3.0.1
→ 3.0.1
├─
d3-format
^3.1.0
→ 3.1.2
├─
d3-geo
^3.1.1
→ 3.1.1
├─
d3-geo-projection
^4.0.0
→ 4.0.0
├─
d3-hierarchy
^3.1.2
→ 3.1.2
├─
d3-interpolate
^3.0.1
→ 3.0.1
├─
d3-path
^3.1.0
→ 3.1.0
├─
d3-random
^3.0.1
→ 3.0.1
├─
d3-regression
^1.3.10
→ 1.3.10
├─
d3-scale
^4.0.2
→ 4.0.2
├─
d3-scale-chromatic
^3.1.0
→ 3.1.0
├─
d3-shape
^3.2.0
→ 3.2.0
├─
d3-time
^3.1.0
→ 3.1.0
├─
simple-swizzle
^0.2.2
→ 0.2.4
├─
@types/geojson
*
→ 7946.0.16
├─
commander
7
→ 7.2.0
├─
d3-time-format
2 - 4
→ 4.1.0
├─
iconv-lite
0.6
→ 0.6.3
├─
is-arrayish
^0.3.1
├─
rw
1
→ 1.3.3
├─
internmap
1 - 2
→ 2.0.3
├─
safer-buffer
>= 2.1.2 < 3.0.0
→ 2.1.2
Changes from v5.1.1
Dependency Changes
Script Changes
+ preinstallFile Changes
1 added
0 removed
1 modified
size delta: +486.9 KB
Risk Dispositions (0 applicable to this version, 3 other)
Accepted rules are downgraded to INFO on future analyses; rejected rules escalate to CRITICAL.
Show 3 disposition(s) that do not match any finding on this version
| Rule | Source | Disposition | Author | Reason | |
|---|---|---|---|---|---|
install-script:preinstall |
install-scripts | reject | AI | AI (install-scripts): Malicious preinstall running obfuscated payload; generalizes to this version and pattern. | |
obfuscated-file:index.js |
source-diff | reject | AI | AI (source-diff): Obfuscated 498KB index.js is a malicious payload, not legitimate build output. | |
url-dep:@antv/setup |
npm-metadata | reject | AI | AI (npm-metadata): SHA-pinned GitHub dep in optionalDependencies is a supply-chain attack vector. |
Review Summary
Risk score: 100 (capped from 248). Findings: 9 high (+225), 2 medium (+20), 1 low (+3), 12 info (+0).
Published to npm: