All @antv/gpt-vis versions

@antv/[email protected] rejected Risk: 100 No license

@antv/gpt-vis @1.2.0

rejected
This version was rejected. It did not pass GreenFlagged's security review and is not served by the registry. The findings and risk dispositions below explain why.
npm Repository Homepage Tarball
100
Risk Score
—
License
Yes
Install Scripts
6
Dependencies
22
Dev Dependencies
939.1 KB
Package Size
Published

Maintainers

lviseifreestyle21soundquietelaine.q.10sturubysakuya223serializedowenxdzhaoyangzhanmeiwjgogogoleungwensendoriiaaronyardsimaqdxq613intchoussusan_annjinke.lilzxuearmy8735atoolbaizndengfupingneoddishjeffy2012zqluafc163pomelo-nwukopiluwakyccnuzindexpanyuqibubkoozengyuekasmineboyu.zljl1ud0ngq1newbyvectorwinniexingchenlulikn9117xdddstsemious2020esoranadia_liubbsqqmxz96102openwaynepearminipddpdyiqianyaozhanbacxxxxxnlaixingui.lxgsusiwen8yanxiongzeyuwangrainy25ghzzhangjunjie-lokiflash1yisi.wangdreammy23biupiubiupiubasketduckxuying1027banxuanpearl_wangbqxbqxbqxalex_zjtduxinyue023wang1212leondt1gaofuhong

Keywords

antvGPTsLLMvisLUI

Dependencies (6)

PackageConstraintRegistry Status
bun ^1.3.13 auto_approved
measury ^0.1.5 auto_approved
@antv/g2 ^5.4.1 auto_approved
@antv/g6 ^5.1.0 auto_approved
@antv/t8 ^0.3.0 auto_approved
@zumer/snapdom ^1.9.14 No greenflagged match

Dev Dependencies (22)

PackageConstraintRegistry Status
husky ^9.1.7 auto_approved
eslint ^9.37.0 auto_approved
father ^4.6.7 auto_approved
vitest ^4.0.18 auto_approved
globals ^15.15.0 auto_approved
ts-node ^10.9.2 auto_approved
prettier ^3.8.1 auto_approved
@eslint/js ^9.37.0 auto_approved
limit-size ^0.1.4 Not imported
typescript ^5.9.3 auto_approved
lint-staged ^15.5.2 auto_approved
npm-run-all ^4.1.5 auto_approved
@commitlint/cli ^19.8.1 No greenflagged match
typescript-eslint ^8.46.1 auto_approved
eslint-plugin-react ^7.37.5 auto_approved
eslint-config-prettier ^9.1.2 auto_approved
eslint-plugin-jsx-a11y ^6.10.2 auto_approved
webpack-bundle-analyzer ^4.10.2 auto_approved
eslint-plugin-react-hooks ^5.2.0 auto_approved
@types/webpack-bundle-analyzer ^4.7.0 auto_approved
@commitlint/config-conventional ^19.8.1 No greenflagged match
prettier-plugin-organize-imports ^4.3.0 auto_approved

Transitive Dependency Tree

95 transitive deps max depth 5
  ├─ @antv/g2 ^5.4.1 → 5.4.8
  ├─ @antv/g6 ^5.1.0 → 5.1.1
  ├─ @antv/t8 ^0.3.0 → 0.3.0
  ├─ @zumer/snapdom ^1.9.14
  ├─ bun ^1.3.13 → 1.3.14
├─ measury ^0.1.5 → 0.1.5
  ├─ @antv/algorithm ^0.1.26 → 0.1.26
  ├─ @antv/component ^2.1.7 → 2.1.11
  ├─ @antv/coord ^0.4.7 → 0.4.7
  ├─ @antv/event-emitter ^0.1.3 → 0.1.3
  ├─ @antv/expr ^1.0.2 → 1.0.2
  ├─ @antv/g ^6.1.24 → 6.3.1
  ├─ @antv/g-canvas ^2.0.48 → 2.2.0
  ├─ @antv/g-plugin-dragndrop ^2.0.38 → 2.1.1
  ├─ @antv/graphlib ^2.0.4 → 2.0.4
  ├─ @antv/hierarchy ^0.7.1 → 0.7.1
  ├─ @antv/layout ^2.0.0 → 2.0.1
  ├─ @antv/scale ^0.5.1 → 0.5.2
  ├─ @antv/util ^3.3.11 → 3.3.11
  ├─ @antv/vendor ^1.0.11 → 1.0.11
  ├─ bubblesets-js ^2.3.4
  ├─ flru ^1.0.2 → 1.0.2
  ├─ pdfast ^0.2.0 → 0.2.0
  ├─ preact ^10.26.5 → 10.29.7
  ├─ tslib ^2.8.1 → 2.8.1
├─ uuid ^11.1.0 → 11.1.0
  ├─ @antv/g-lite 2.7.0 → 2.7.0
  ├─ @antv/g-math 3.1.0 → 3.1.0
  ├─ @babel/runtime ^7.25.6 → 7.29.7
  ├─ @types/d3-array ^3.2.1 → 3.2.2
  ├─ @types/d3-color ^3.1.3 → 3.1.3
  ├─ @types/d3-dispatch ^3.0.6 → 3.0.7
  ├─ @types/d3-dsv ^3.0.7 → 3.0.7
  ├─ @types/d3-ease ^3.0.2 → 3.0.2
  ├─ @types/d3-fetch ^3.0.7 → 3.0.7
  ├─ @types/d3-force ^3.0.10 → 3.0.10
  ├─ @types/d3-format ^3.0.4 → 3.0.4
  ├─ @types/d3-geo ^3.1.0 → 3.1.0
  ├─ @types/d3-hierarchy ^3.1.7 → 3.1.7
  ├─ @types/d3-interpolate ^3.0.4 → 3.0.4
  ├─ @types/d3-path ^3.1.0 → 3.1.1
  ├─ @types/d3-quadtree ^3.0.6 → 3.0.6
  ├─ @types/d3-random ^3.0.3 → 3.0.3
  ├─ @types/d3-scale ^4.0.9 → 4.0.9
  ├─ @types/d3-scale-chromatic ^3.1.0 → 3.1.0
  ├─ @types/d3-shape ^3.1.7 → 3.1.8
  ├─ @types/d3-time ^3.0.4 → 3.0.4
  ├─ @types/d3-timer ^3.0.2 → 3.0.2
  ├─ color-string ^1.5.5 → 1.9.1
  ├─ comlink ^4.4.1 → 4.4.2
  ├─ d3-array ^3.2.4
  ├─ d3-color ^3.1.0 → 3.1.0
  ├─ d3-dispatch ^3.0.1 → 3.0.1
  ├─ d3-dsv ^3.0.1 → 3.0.1
  ├─ d3-ease ^3.0.1 → 3.0.1
  ├─ d3-fetch ^3.0.1 → 3.0.1
  ├─ d3-force ^3.0.0 → 3.0.0
  ├─ d3-force-3d ^3.0.5 → 3.0.6
  ├─ d3-format ^3.1.0 → 3.1.2
  ├─ d3-geo ^3.1.1 → 3.1.1
  ├─ d3-geo-projection ^4.0.0 → 4.0.0
  ├─ d3-hierarchy ^3.1.2 → 3.1.2
  ├─ d3-interpolate ^3.0.1 → 3.0.1
  ├─ d3-octree ^1.0.2 → 1.1.0
  ├─ d3-path ^3.1.0 → 3.1.0
  ├─ d3-quadtree ^3.0.1 → 3.0.1
  ├─ d3-random ^3.0.1 → 3.0.1
  ├─ d3-regression ^1.3.10 → 1.3.10
  ├─ d3-scale ^4.0.2 → 4.0.2
  ├─ d3-scale-chromatic ^3.1.0 → 3.1.0
  ├─ d3-shape ^3.2.0 → 3.2.0
  ├─ d3-time ^3.1.0 → 3.1.0
  ├─ d3-timer ^3.0.1 → 3.0.1
  ├─ dagre ^0.8.5 → 0.8.5
  ├─ fast-deep-equal ^3.1.3 → 3.1.3
  ├─ fecha ^4.2.1 → 4.2.3
  ├─ gl-matrix ^3.3.0 → 3.4.4
  ├─ html2canvas ^1.4.1 → 1.4.1
├─ ml-matrix ^6.10.4 → 6.14.0
  ├─ @types/geojson * → 7946.0.16
  ├─ color-name ^1.0.0 → 1.1.4
  ├─ commander 7 → 7.2.0
  ├─ d3-binarytree 1 → 1.0.2
  ├─ d3-time-format 2 - 4 → 4.1.0
  ├─ eventemitter3 ^5.0.1 → 5.0.4
  ├─ graphlib ^2.1.8 → 2.1.8
  ├─ iconv-lite 0.6 → 0.6.3
  ├─ is-any-array ^3.0.0 → 3.0.0
  ├─ lodash ^4.17.15 → 4.18.1
  ├─ ml-array-rescale ^2.0.0 → 2.0.0
  ├─ rw 1 → 1.3.3
├─ simple-swizzle ^0.2.2 → 0.2.4
  ├─ internmap 1 - 2 → 2.0.3
  ├─ is-arrayish ^0.3.1
  ├─ safer-buffer >= 2.1.2 < 3.0.0 → 2.1.2

Changes from v1.0.0

Dependency Changes

ChangePackageVersion
added bun ^1.3.13

Script Changes

+ preinstall

File Changes

1 added 0 removed 1 modified size delta: +487.8 KB

Risk Dispositions (0 applicable to this version, 5 other)

Accepted rules are downgraded to INFO on future analyses; rejected rules escalate to CRITICAL.

Show 5 disposition(s) that do not match any finding on this version
Rule Source Disposition Author Reason
install-script:preinstall install-scripts reject AI AI (install-scripts): Newly added preinstall runs obfuscated index.js — malicious payload delivery mechanism.
url-dep:@antv/setup npm-metadata reject AI AI (npm-metadata): SHA-pinned GitHub optionalDependency matches known supply-chain attack pattern; generalizes to this package.
semgrep:obfuscation-while-true semgrep reject AI AI (semgrep): Obfuscated payload in index.js executed by preinstall; clearly malicious.
semgrep:obfuscation-hex-functions semgrep reject AI AI (semgrep): Hex-obfuscated functions in the preinstall-executed index.js confirm malicious obfuscation.
semgrep:env-spread semgrep reject AI AI (semgrep): process.env spread inside obfuscated preinstall payload indicates credential exfiltration.

Review Summary

Risk score: 100 (capped from 286). Findings: 7 critical (+280), 2 low (+6).

Published to npm: