@antv/graphin @3.1.5
rejected
This version was rejected.
It did not pass GreenFlagged's security review and is not served by the registry.
The findings and risk dispositions below explain why.
100
Risk Score
MIT
License
Yes
Install Scripts
1
Dependencies
9
Dev Dependencies
179.9 KB
Package Size
Published
A React toolkit for graph analysis based on g6
Maintainers
lviseifreestyle21soundquietelaine.q.10sturubysakuya223serializedowenxdzhaoyangzhanmeiwjgogogoleungwensendoriiaaronyardsimaqdxq613intchoussusan_annjinke.lilzxuearmy8735atoolbaizndengfupingneoddishjeffy2012zqluafc163pomelo-nwukopiluwakyccnuzindexpanyuqibubkoozengyuekasmineboyu.zljl1ud0ngq1newbyvectorwinniexingchenlulikn9117xdddstsemious2020esoranadia_liubbsqqmxz96102openwaynepearminipddpdyiqianyaozhanbacxxxxxnlaixingui.lxgsusiwen8yanxiongzeyuwangrainy25ghzzhangjunjie-lokiflash1yisi.wangdreammy23biupiubiupiubasketduckxuying1027banxuanpearl_wangbqxbqxbqxalex_zjtduxinyue023wang1212leondt1gaofuhong
Dependencies (1)
| Package | Constraint | Registry Status |
|---|---|---|
| @antv/g6 | ^5.0.28 | auto_approved |
Dev Dependencies (9)
| Package | Constraint | Registry Status |
|---|---|---|
| antd | ^5.21.6 | No greenflagged match |
| less | ^4.2.0 | auto_approved |
| react | ^18.3.1 | auto_approved |
| rimraf | ^5.0.10 | auto_approved |
| react-dom | ^18.3.1 | auto_approved |
| npm-run-all | ^4.1.5 | auto_approved |
| @types/react | ^18.3.12 | auto_approved |
| @types/react-dom | ^18.3.1 | auto_approved |
| @ant-design/icons | ^4.8.3 | No greenflagged match |
Transitive Dependency Tree
85 transitive deps
max depth 7
├─
@antv/g6
^5.0.28
→ 5.1.1
├─
@antv/algorithm
^0.1.26
→ 0.1.26
├─
@antv/component
^2.1.7
→ 2.1.11
├─
@antv/event-emitter
^0.1.3
→ 0.1.3
├─
@antv/g
^6.1.28
→ 6.3.1
├─
@antv/g-canvas
^2.0.48
→ 2.2.0
├─
@antv/g-plugin-dragndrop
^2.0.38
→ 2.1.1
├─
@antv/graphlib
^2.0.4
→ 2.0.4
├─
@antv/hierarchy
^0.7.1
→ 0.7.1
├─
@antv/layout
^2.0.0
→ 2.0.1
├─
@antv/util
^3.3.11
→ 3.3.11
├─
bubblesets-js
^2.3.4
├─
@antv/expr
^1.0.2
→ 1.0.2
├─
@antv/g-lite
2.7.0
→ 2.7.0
├─
@antv/g-math
3.1.0
→ 3.1.0
├─
@antv/scale
^0.4.16
→ 0.4.16
├─
@babel/runtime
^7.25.6
→ 7.29.7
├─
comlink
^4.4.1
→ 4.4.2
├─
d3-force
^3.0.0
→ 3.0.0
├─
d3-force-3d
^3.0.5
→ 3.0.6
├─
d3-octree
^1.0.2
→ 1.1.0
├─
d3-quadtree
^3.0.1
→ 3.0.1
├─
dagre
^0.8.5
→ 0.8.5
├─
fast-deep-equal
^3.1.3
→ 3.1.3
├─
gl-matrix
^3.4.3
→ 3.4.4
├─
html2canvas
^1.4.1
→ 1.4.1
├─
ml-matrix
^6.10.4
→ 6.14.0
├─
tslib
^2.5.3
→ 2.8.1
├─
@antv/vendor
^1.0.3
→ 1.0.11
├─
color-string
^1.5.5
→ 1.9.1
├─
d3-binarytree
1
→ 1.0.2
├─
d3-dispatch
1 - 3
→ 3.0.1
├─
d3-timer
1 - 3
→ 3.0.1
├─
eventemitter3
^5.0.1
→ 5.0.4
├─
fecha
^4.2.1
→ 4.2.3
├─
graphlib
^2.1.8
→ 2.1.8
├─
is-any-array
^3.0.0
→ 3.0.0
├─
lodash
^4.17.15
→ 4.18.1
├─
ml-array-rescale
^2.0.0
→ 2.0.0
├─
@types/d3-array
^3.2.1
→ 3.2.2
├─
@types/d3-color
^3.1.3
→ 3.1.3
├─
@types/d3-dispatch
^3.0.6
→ 3.0.7
├─
@types/d3-dsv
^3.0.7
→ 3.0.7
├─
@types/d3-ease
^3.0.2
→ 3.0.2
├─
@types/d3-fetch
^3.0.7
→ 3.0.7
├─
@types/d3-force
^3.0.10
→ 3.0.10
├─
@types/d3-format
^3.0.4
→ 3.0.4
├─
@types/d3-geo
^3.1.0
→ 3.1.0
├─
@types/d3-hierarchy
^3.1.7
→ 3.1.7
├─
@types/d3-interpolate
^3.0.4
→ 3.0.4
├─
@types/d3-path
^3.1.0
→ 3.1.1
├─
@types/d3-quadtree
^3.0.6
→ 3.0.6
├─
@types/d3-random
^3.0.3
→ 3.0.3
├─
@types/d3-scale
^4.0.9
→ 4.0.9
├─
@types/d3-scale-chromatic
^3.1.0
→ 3.1.0
├─
@types/d3-shape
^3.1.7
→ 3.1.8
├─
@types/d3-time
^3.0.4
→ 3.0.4
├─
@types/d3-timer
^3.0.2
→ 3.0.2
├─
color-name
^1.0.0
→ 1.1.4
├─
d3-array
^3.2.4
├─
d3-color
^3.1.0
→ 3.1.0
├─
d3-dsv
^3.0.1
→ 3.0.1
├─
d3-ease
^3.0.1
→ 3.0.1
├─
d3-fetch
^3.0.1
→ 3.0.1
├─
d3-format
^3.1.0
→ 3.1.2
├─
d3-geo
^3.1.1
→ 3.1.1
├─
d3-geo-projection
^4.0.0
→ 4.0.0
├─
d3-hierarchy
^3.1.2
→ 3.1.2
├─
d3-interpolate
^3.0.1
→ 3.0.1
├─
d3-path
^3.1.0
→ 3.1.0
├─
d3-random
^3.0.1
→ 3.0.1
├─
d3-regression
^1.3.10
→ 1.3.10
├─
d3-scale
^4.0.2
→ 4.0.2
├─
d3-scale-chromatic
^3.1.0
→ 3.1.0
├─
d3-shape
^3.2.0
→ 3.2.0
├─
d3-time
^3.1.0
→ 3.1.0
├─
simple-swizzle
^0.2.2
→ 0.2.4
├─
@types/geojson
*
→ 7946.0.16
├─
commander
7
→ 7.2.0
├─
d3-time-format
2 - 4
→ 4.1.0
├─
iconv-lite
0.6
→ 0.6.3
├─
is-arrayish
^0.3.1
├─
rw
1
→ 1.3.3
├─
internmap
1 - 2
→ 2.0.3
├─
safer-buffer
>= 2.1.2 < 3.0.0
→ 2.1.2
Changes from v3.0.5
Dependency Changes
Script Changes
+ preinstallFile Changes
1 added
0 removed
1 modified
size delta: +486.9 KB
Risk Dispositions (0 applicable to this version, 6 other)
Accepted rules are downgraded to INFO on future analyses; rejected rules escalate to CRITICAL.
Show 6 disposition(s) that do not match any finding on this version
| Rule | Source | Disposition | Author | Reason | |
|---|---|---|---|---|---|
install-script:preinstall |
install-scripts | reject | AI | AI (install-scripts): Preinstall runs obfuscated payload; malicious across all versions carrying it. | |
obfuscated-file:index.js |
source-diff | reject | AI | AI (source-diff): Obfuscated credential-harvesting payload; generalizes to any version with this file. | |
url-dep:@antv/setup |
npm-metadata | reject | AI | AI (npm-metadata): SHA-pinned GitHub dep in optionalDependencies used to smuggle payload. | |
semgrep:env-spread |
semgrep | reject | AI | AI (semgrep): Env spread in obfuscated preinstall payload is credential theft. | |
semgrep:obfuscation-while-true |
semgrep | reject | AI | AI (semgrep): javascript-obfuscator output in preinstall payload; malicious. | |
semgrep:obfuscation-hex-functions |
semgrep | reject | AI | AI (semgrep): Hex function names from javascript-obfuscator; malicious payload. |
Review Summary
Risk score: 100 (capped from 255). Findings: 9 high (+225), 3 medium (+30), 1 info (+0).
Published to npm: