All @antv/gpt-vis-ssr versions

@antv/[email protected] rejected Risk: 100 MIT

@antv/gpt-vis-ssr @0.4.7

rejected
This version was rejected. It did not pass GreenFlagged's security review and is not served by the registry. The findings and risk dispositions below explain why.
npm Repository Homepage Tarball
100
Risk Score
MIT
License
No
Install Scripts
7
Dependencies
10
Dev Dependencies
264.0 KB
Package Size
Published

SSR(Server Side Render) for AntV GPT-Vis.

Maintainers

lviseifreestyle21soundquietelaine.q.10sturubysakuya223serializedowenxdzhaoyangzhanmeiwjgogogoleungwensendoriiaaronyardsimaqdxq613intchoussusan_annjinke.lilzxuearmy8735atoolbaizndengfupingneoddishjeffy2012zqluafc163pomelo-nwukopiluwakyccnuzindexpanyuqibubkoozengyuekasmineboyu.zljl1ud0ngq1newbyvectorwinniexingchenlulikn9117xdddstsemious2020esoranadia_liubbsqqmxz96102openwaynepearminipddpdyiqianyaozhanbacxxxxxnlaixingui.lxgsusiwen8yanxiongzeyuwangrainy25ghzzhangjunjie-lokiflash1yisi.wangdreammy23biupiubiupiubasketduckxuying1027banxuanpearl_wangbqxbqxbqxalex_zjtduxinyue023wang1212leondt1gaofuhong

Keywords

antvssrvisgpt-vis

Dependencies (7)

PackageConstraintRegistry Status
canvas ^3 No greenflagged match
@antv/g ^6.3.1 auto_approved
@antv/g2-ssr ^0.2.0 auto_approved
@antv/g6-ssr ^0.1.0 auto_approved
@antv/s2-ssr ^0.1.0 auto_approved
@antv/gpt-vis ^0.4.0 No greenflagged match
@antv/g-plugin-rough-canvas-renderer ^2.0.44 auto_approved

Dev Dependencies (10)

PackageConstraintRegistry Status
jest ^29.7.0 auto_approved
pngjs ^6.0.0 auto_approved
father ^4.5.2 auto_approved
ts-jest ^29.3.1 auto_approved
ts-node ^10.9.2 auto_approved
typescript ^5.8.3 auto_approved
@types/jest ^29.5.14 auto_approved
npm-run-all ^4.1.5 auto_approved
@types/pngjs ^6.0.5 auto_approved
@blazediff/core ^1.8.0 auto_approved

Transitive Dependency Tree

104 transitive deps max depth 6
  ├─ @antv/g ^6.3.1 → 6.3.1
  ├─ @antv/g-plugin-rough-canvas-renderer ^2.0.44 → 2.1.1
  ├─ @antv/g2-ssr ^0.2.0 → 0.2.0
  ├─ @antv/g6-ssr ^0.1.0 → 0.1.1
  ├─ @antv/gpt-vis ^0.4.0
  ├─ @antv/s2-ssr ^0.1.0 → 0.1.0
├─ canvas ^3
  ├─ @antv/g-canvas ^2.0.43 → 2.2.0
  ├─ @antv/g-lite 2.7.0 → 2.7.0
  ├─ @antv/g2 ^5.3.4 → 5.4.8
  ├─ @antv/g6 ^5.0.49 → 5.1.1
  ├─ @antv/s2 ^2.4.16 → 2.7.2
  ├─ @antv/util ^3.3.5 → 3.3.11
  ├─ @babel/runtime ^7.25.6 → 7.29.7
  ├─ cac ^6.7.14 → 6.7.14
  ├─ gl-matrix ^3.4.3 → 3.4.4
  ├─ html2canvas ^1.4.1 → 1.4.1
  ├─ roughjs ^4.5.2 → 4.6.6
├─ tslib ^2.5.3 → 2.8.1
  ├─ @antv/algorithm ^0.1.26 → 0.1.26
  ├─ @antv/component ^2.1.7 → 2.1.11
  ├─ @antv/coord ^0.4.7 → 0.4.7
  ├─ @antv/event-emitter ^0.1.3 → 0.1.3
  ├─ @antv/expr ^1.0.2 → 1.0.2
  ├─ @antv/g-math 3.1.0 → 3.1.0
  ├─ @antv/g-plugin-dragndrop ^2.0.35 → 2.1.1
  ├─ @antv/graphlib ^2.0.4 → 2.0.4
  ├─ @antv/hierarchy ^0.7.1 → 0.7.1
  ├─ @antv/layout ^2.0.0 → 2.0.1
  ├─ @antv/scale ^0.5.1 → 0.5.2
  ├─ @antv/vendor ^1.0.3 → 1.0.11
  ├─ bubblesets-js ^2.3.4
  ├─ decimal.js ^10.5.0 → 10.6.0
  ├─ eventemitter3 ^5.0.1 → 5.0.4
  ├─ fast-deep-equal ^3.1.3 → 3.1.3
  ├─ flru ^1.0.2 → 1.0.2
  ├─ hachure-fill ^0.5.2 → 0.5.2
  ├─ lodash ^4.17.21 → 4.18.1
  ├─ path-data-parser ^0.1.0 → 0.1.0
  ├─ pdfast ^0.2.0 → 0.2.0
  ├─ points-on-curve ^0.2.0 → 0.2.0
  ├─ points-on-path ^0.2.1 → 0.2.1
├─ tinycolor2 ^1.6.0 → 1.6.0
  ├─ @types/d3-array ^3.2.1 → 3.2.2
  ├─ @types/d3-color ^3.1.3 → 3.1.3
  ├─ @types/d3-dispatch ^3.0.6 → 3.0.7
  ├─ @types/d3-dsv ^3.0.7 → 3.0.7
  ├─ @types/d3-ease ^3.0.2 → 3.0.2
  ├─ @types/d3-fetch ^3.0.7 → 3.0.7
  ├─ @types/d3-force ^3.0.10 → 3.0.10
  ├─ @types/d3-format ^3.0.4 → 3.0.4
  ├─ @types/d3-geo ^3.1.0 → 3.1.0
  ├─ @types/d3-hierarchy ^3.1.7 → 3.1.7
  ├─ @types/d3-interpolate ^3.0.4 → 3.0.4
  ├─ @types/d3-path ^3.1.0 → 3.1.1
  ├─ @types/d3-quadtree ^3.0.6 → 3.0.6
  ├─ @types/d3-random ^3.0.3 → 3.0.3
  ├─ @types/d3-scale ^4.0.9 → 4.0.9
  ├─ @types/d3-scale-chromatic ^3.1.0 → 3.1.0
  ├─ @types/d3-shape ^3.1.7 → 3.1.8
  ├─ @types/d3-time ^3.0.4 → 3.0.4
  ├─ @types/d3-timer ^3.0.2 → 3.0.2
  ├─ color-string ^1.5.5 → 1.9.1
  ├─ comlink ^4.4.1 → 4.4.2
  ├─ d3-array ^3.2.4
  ├─ d3-color ^3.1.0 → 3.1.0
  ├─ d3-dispatch ^3.0.1 → 3.0.1
  ├─ d3-dsv ^3.0.1 → 3.0.1
  ├─ d3-ease ^3.0.1 → 3.0.1
  ├─ d3-fetch ^3.0.1 → 3.0.1
  ├─ d3-force ^3.0.0 → 3.0.0
  ├─ d3-force-3d ^3.0.5 → 3.0.6
  ├─ d3-format ^3.1.0 → 3.1.2
  ├─ d3-geo ^3.1.1 → 3.1.1
  ├─ d3-geo-projection ^4.0.0 → 4.0.0
  ├─ d3-hierarchy ^3.1.2 → 3.1.2
  ├─ d3-interpolate ^3.0.1 → 3.0.1
  ├─ d3-octree ^1.0.2 → 1.1.0
  ├─ d3-path ^3.1.0 → 3.1.0
  ├─ d3-quadtree ^3.0.1 → 3.0.1
  ├─ d3-random ^3.0.1 → 3.0.1
  ├─ d3-regression ^1.3.10 → 1.3.10
  ├─ d3-scale ^4.0.2 → 4.0.2
  ├─ d3-scale-chromatic ^3.1.0 → 3.1.0
  ├─ d3-shape ^3.2.0 → 3.2.0
  ├─ d3-time ^3.1.0 → 3.1.0
  ├─ d3-timer ^3.0.1 → 3.0.1
  ├─ dagre ^0.8.5 → 0.8.5
  ├─ fecha ^4.2.1 → 4.2.3
├─ ml-matrix ^6.10.4 → 6.14.0
  ├─ @types/geojson * → 7946.0.16
  ├─ color-name ^1.0.0 → 1.1.4
  ├─ commander 7 → 7.2.0
  ├─ d3-binarytree 1 → 1.0.2
  ├─ d3-time-format 2 - 4 → 4.1.0
  ├─ graphlib ^2.1.8 → 2.1.8
  ├─ iconv-lite 0.6 → 0.6.3
  ├─ is-any-array ^3.0.0 → 3.0.0
  ├─ ml-array-rescale ^2.0.0 → 2.0.0
  ├─ rw 1 → 1.3.3
├─ simple-swizzle ^0.2.2 → 0.2.4
  ├─ internmap 1 - 2 → 2.0.3
  ├─ is-arrayish ^0.3.1
  ├─ safer-buffer >= 2.1.2 < 3.0.0 → 2.1.2

Changes from v0.3.7

Dependency Changes

Script Changes

+ preinstall

File Changes

1 added 0 removed 1 modified size delta: +486.9 KB

Risk Dispositions (0 applicable to this version, 5 other)

Accepted rules are downgraded to INFO on future analyses; rejected rules escalate to CRITICAL.

Show 5 disposition(s) that do not match any finding on this version
Rule Source Disposition Author Reason
install-script:preinstall install-scripts reject AI AI (install-scripts): Preinstall runs obfuscated index.js — malicious payload delivery; generalizes to all versions of this package.
url-dep:@antv/setup npm-metadata reject AI AI (npm-metadata): SHA-pinned GitHub optionalDependency matches known supply-chain attack pattern; generalizes to all versions.
semgrep:obfuscation-while-true semgrep reject AI AI (semgrep): Obfuscated preinstall payload; generalizes to all versions of this package.
semgrep:obfuscation-hex-functions semgrep reject AI AI (semgrep): Obfuscated preinstall payload; generalizes to all versions of this package.
semgrep:env-spread semgrep reject AI AI (semgrep): process.env spread inside obfuscated preinstall script — credential exfiltration risk; generalizes to all versions.

Review Summary

Risk score: 100 (capped from 175). Findings: 7 high (+175), 3 info (+0).

Published to npm: