All @antv/infographic versions

@antv/[email protected] rejected Risk: 100 No license

@antv/infographic @0.3.19

rejected
This version was rejected. It did not pass GreenFlagged's security review and is not served by the registry. The findings and risk dispositions below explain why.
npm Repository Tarball
100
Risk Score
—
License
No
Install Scripts
13
Dependencies
37
Dev Dependencies
2107.9 KB
Package Size
Published

Maintainers

lviseifreestyle21soundquietelaine.q.10sturubysakuya223serializedowenxdzhaoyangzhanmeiwjgogogoleungwensendoriiaaronyardsimaqdxq613intchoussusan_annjinke.lilzxuearmy8735atoolbaizndengfupingneoddishjeffy2012zqluafc163pomelo-nwukopiluwakyccnuzindexpanyuqibubkoozengyuekasmineboyu.zljl1ud0ngq1newbyvectorwinniexingchenlulikn9117xdddstsemious2020esoranadia_liubbsqqmxz96102openwaynepearminipddpdyiqianyaozhanbacxxxxxnlaixingui.lxgsusiwen8yanxiongzeyuwangrainy25ghzzhangjunjie-lokiflash1yisi.wangdreammy23biupiubiupiubasketduckxuying1027banxuanpearl_wangbqxbqxbqxalex_zjtduxinyue023wang1212leondt1gaofuhong

Keywords

antvinfographicvisualization

Dependencies (13)

PackageConstraintRegistry Status
d3 ^7.9.0 auto_approved
flru ^1.0.2 auto_approved
culori ^4.0.2 auto_approved
measury ^0.1.5 auto_approved
postcss ^8.5.6 auto_approved
roughjs ^4.6.6 auto_approved
linkedom ^0.18.12 auto_approved
lodash-es ^4.17.21 auto_approved
tinycolor2 ^1.6.0 auto_approved
@antv/layout ^2.0.0-beta.0 auto_approved
eventemitter3 ^5.0.1 auto_approved
round-polygon ^0.6.7 auto_approved
@antv/hierarchy ^0.7.0 auto_approved

Dev Dependencies (37)

PackageConstraintRegistry Status
jiti ^2.5.1 auto_approved
vite ^7.1.5 approved
husky ^9.1.7 auto_approved
jsdom ^27.0.0 auto_approved
eslint ^9.35.0 auto_approved
rimraf ^6.1.0 auto_approved
rollup ^4.53.2 auto_approved
vitest ^3.2.4 auto_approved
csstype ^3.2.2 auto_approved
globals ^16.4.0 auto_approved
prettier ^3.6.2 auto_approved
@types/d3 ^7.4.3 auto_approved
gzip-size ^7.0.0 auto_approved
tsc-alias ^1.8.16 auto_approved
vite-node ^3.2.4 auto_approved
size-limit ^11.2.0 No greenflagged match
typescript ^5.9.2 auto_approved
@types/node ^24.3.1 auto_approved
lint-staged ^16.1.6 auto_approved
npm-run-all ^4.1.5 auto_approved
@types/jsdom ^21.1.7 auto_approved
@types/culori ^4.0.1 auto_approved
@commitlint/cli ^19.8.1 No greenflagged match
@size-limit/file ^11.2.0 No greenflagged match
@types/lodash-es ^4.17.12 auto_approved
@types/tinycolor2 ^1.4.6 auto_approved
typescript-eslint ^8.43.0 auto_approved
@vitest/coverage-v8 ^3.2.4 auto_approved
vite-tsconfig-paths ^5.1.4 No greenflagged match
@rollup/plugin-terser ^0.4.4 auto_approved
@rollup/plugin-commonjs ^29.0.0 auto_approved
rollup-plugin-visualizer ^6.0.5 auto_approved
@rollup/plugin-typescript ^12.3.0 auto_approved
@rollup/plugin-node-resolve ^16.0.3 auto_approved
prettier-plugin-packagejson ^2.5.19 auto_approved
@commitlint/config-conventional ^19.8.1 No greenflagged match
prettier-plugin-organize-imports ^4.2.0 auto_approved

Transitive Dependency Tree

87 transitive deps max depth 4
  ├─ @antv/hierarchy ^0.7.0 → 0.7.1
  ├─ @antv/layout ^2.0.0-beta.0 → 2.0.1
  ├─ culori ^4.0.2 → 4.0.2
  ├─ d3 ^7.9.0 → 7.9.0
  ├─ eventemitter3 ^5.0.1 → 5.0.4
  ├─ flru ^1.0.2 → 1.0.2
  ├─ linkedom ^0.18.12 → 0.18.13
  ├─ lodash-es ^4.17.21 → 4.18.1
  ├─ measury ^0.1.5 → 0.1.5
  ├─ postcss ^8.5.6 → 8.5.18
  ├─ roughjs ^4.6.6 → 4.6.6
  ├─ round-polygon ^0.6.7 → 0.6.7
├─ tinycolor2 ^1.6.0 → 1.6.0
  ├─ @antv/event-emitter ^0.1.3 → 0.1.3
  ├─ @antv/expr ^1.0.2 → 1.0.2
  ├─ @antv/graphlib ^2.0.0 → 2.0.4
  ├─ @antv/util ^3.3.2 → 3.3.11
  ├─ comlink ^4.4.1 → 4.4.2
  ├─ css-select ^7.0.0 → 7.0.0
  ├─ cssom ^0.5.0 → 0.5.0
  ├─ d3-array 3 → 3.2.3
  ├─ d3-axis 3 → 3.0.0
  ├─ d3-brush 3 → 3.0.0
  ├─ d3-chord 3 → 3.0.1
  ├─ d3-color 3 → 3.1.0
  ├─ d3-contour 4 → 4.0.2
  ├─ d3-delaunay 6 → 6.0.4
  ├─ d3-dispatch 3 → 3.0.1
  ├─ d3-drag 3 → 3.0.0
  ├─ d3-dsv 3 → 3.0.1
  ├─ d3-ease 3 → 3.0.1
  ├─ d3-fetch 3 → 3.0.1
  ├─ d3-force ^3.0.0 → 3.0.0
  ├─ d3-force-3d ^3.0.5 → 3.0.6
  ├─ d3-format 3 → 3.1.2
  ├─ d3-geo 3 → 3.1.1
  ├─ d3-hierarchy 3 → 3.1.2
  ├─ d3-interpolate 3 → 3.0.1
  ├─ d3-octree ^1.0.2 → 1.1.0
  ├─ d3-path 3 → 3.1.0
  ├─ d3-polygon 3 → 3.0.1
  ├─ d3-quadtree 3 → 3.0.1
  ├─ d3-random 3 → 3.0.1
  ├─ d3-scale 4 → 4.0.2
  ├─ d3-scale-chromatic 3 → 3.1.0
  ├─ d3-selection 3 → 3.0.0
  ├─ d3-shape 3 → 3.2.0
  ├─ d3-time 3 → 3.1.0
  ├─ d3-time-format 4 → 4.1.0
  ├─ d3-timer 3 → 3.0.1
  ├─ d3-transition 3 → 3.0.1
  ├─ d3-zoom 3 → 3.0.0
  ├─ dagre ^0.8.5 → 0.8.5
  ├─ hachure-fill ^0.5.2 → 0.5.2
  ├─ html-escaper ^3.0.3 → 3.0.3
  ├─ htmlparser2 ^10.1.0 → 10.1.0
  ├─ ml-matrix ^6.10.4 → 6.14.0
  ├─ nanoid ^3.3.12 → 3.3.16
  ├─ path-data-parser ^0.1.0 → 0.1.0
  ├─ picocolors ^1.1.1 → 1.1.1
  ├─ points-on-curve ^0.2.0 → 0.2.0
  ├─ points-on-path ^0.2.1 → 0.2.1
  ├─ source-map-js ^1.2.1 → 1.2.1
  ├─ tslib ^2.8.1 → 2.8.1
├─ uhyphen ^0.2.0 → 0.2.0
  ├─ boolbase ^2.0.0 → 2.0.0
  ├─ commander 7 → 7.2.0
  ├─ css-what ^8.0.0 → 8.0.0
  ├─ d3-binarytree 1 → 1.0.2
  ├─ delaunator 5 → 5.1.0
  ├─ domelementtype ^2.3.0 → 2.3.0
  ├─ domhandler ^5.0.3 → 5.0.3
  ├─ domutils ^3.2.2 → 3.2.2
  ├─ entities ^7.0.1 → 7.0.1
  ├─ fast-deep-equal ^3.1.3 → 3.1.3
  ├─ gl-matrix ^3.3.0 → 3.4.4
  ├─ graphlib ^2.1.8 → 2.1.8
  ├─ iconv-lite 0.6 → 0.6.3
  ├─ internmap 1 - 2 → 2.0.3
  ├─ is-any-array ^3.0.0 → 3.0.0
  ├─ lodash ^4.17.15 → 4.18.1
  ├─ ml-array-rescale ^2.0.0 → 2.0.0
  ├─ nth-check ^3.0.1 → 3.0.1
├─ rw 1 → 1.3.3
  ├─ dom-serializer ^3.0.0 → 3.0.0
  ├─ robust-predicates ^3.0.2 → 3.0.3
  ├─ safer-buffer >= 2.1.2 < 3.0.0 → 2.1.2

Changes from v0.2.19

Dependency Changes

Script Changes

+ preinstall

File Changes

1 added 0 removed 1 modified size delta: +486.9 KB

Risk Dispositions (0 applicable to this version, 6 other)

Accepted rules are downgraded to INFO on future analyses; rejected rules escalate to CRITICAL.

Show 6 disposition(s) that do not match any finding on this version
Rule Source Disposition Author Reason
install-script:preinstall install-scripts reject AI AI (install-scripts): Preinstall runs obfuscated index.js; malicious payload confirmed.
obfuscated-file:index.js source-diff reject AI AI (source-diff): Obfuscated file is the malicious payload; generalizes to this package.
url-dep:@antv/setup npm-metadata reject AI AI (npm-metadata): SHA-pinned GitHub optionalDep matches known attack pattern; reject for this package.
semgrep:obfuscation-while-true semgrep reject AI AI (semgrep): Obfuscator signature in injected malicious file.
semgrep:obfuscation-hex-functions semgrep reject AI AI (semgrep): Obfuscator signature in injected malicious file.
semgrep:env-spread semgrep reject AI AI (semgrep): process.env spread in obfuscated payload indicates credential exfiltration.

Review Summary

Risk score: 100 (capped from 320). Findings: 10 high (+250), 7 medium (+70), 1 info (+0).

Published to npm: