All @antv/vendor versions

@antv/[email protected] rejected Risk: 100 No license

@antv/vendor @1.2.11

rejected
This version was rejected. It did not pass GreenFlagged's security review and is not served by the registry. The findings and risk dispositions below explain why.
npm Repository Tarball
100
Risk Score
—
License
No
Install Scripts
42
Dependencies
5
Dev Dependencies
393.0 KB
Package Size
Published

Maintainers

lviseifreestyle21soundquietelaine.q.10sturubysakuya223serializedowenxdzhaoyangzhanmeiwjgogogoleungwensendoriiaaronyardsimaqdxq613intchoussusan_annjinke.lilzxuearmy8735atoolbaizndengfupingneoddishjeffy2012zqluafc163pomelo-nwukopiluwakyccnuzindexpanyuqibubkoozengyuekasmineboyu.zljl1ud0ngq1newbyvectorwinniexingchenlulikn9117xdddstsemious2020esoranadia_liubbsqqmxz96102openwaynepearminipddpdyiqianyaozhanbacxxxxxnlaixingui.lxgsusiwen8yanxiongzeyuwangrainy25ghzzhangjunjie-lokiflash1yisi.wangdreammy23biupiubiupiubasketduckxuying1027banxuanpearl_wangbqxbqxbqxalex_zjtduxinyue023wang1212leondt1gaofuhong

Keywords

antvd3

Dependencies (42)

PackageConstraintRegistry Status
bun ^1.3.13 auto_approved
d3-dsv ^3.0.1 auto_approved
d3-geo ^3.1.1 auto_approved
d3-ease ^3.0.1 auto_approved
d3-path ^3.1.0 auto_approved
d3-time ^3.1.0 auto_approved
d3-array ^3.2.4 No greenflagged match
d3-color ^3.1.0 auto_approved
d3-fetch ^3.0.1 auto_approved
d3-force ^3.0.0 auto_approved
d3-scale ^4.0.2 auto_approved
d3-shape ^3.2.0 auto_approved
d3-timer ^3.0.1 auto_approved
d3-format ^3.1.0 auto_approved
d3-random ^3.0.1 auto_approved
d3-dispatch ^3.0.1 auto_approved
d3-force-3d ^3.0.5 auto_approved
d3-quadtree ^3.0.1 auto_approved
d3-hierarchy ^3.1.2 auto_approved
@types/d3-dsv ^3.0.7 auto_approved
@types/d3-geo ^3.1.0 auto_approved
d3-regression ^1.3.10 auto_approved
@types/d3-ease ^3.0.2 auto_approved
@types/d3-path ^3.1.0 auto_approved
@types/d3-time ^3.0.4 auto_approved
d3-interpolate ^3.0.1 auto_approved
@types/d3-array ^3.2.1 auto_approved
@types/d3-color ^3.1.3 auto_approved
@types/d3-fetch ^3.0.7 auto_approved
@types/d3-force ^3.0.10 auto_approved
@types/d3-scale ^4.0.9 auto_approved
@types/d3-shape ^3.1.7 auto_approved
@types/d3-timer ^3.0.2 auto_approved
@types/d3-format ^3.0.4 auto_approved
@types/d3-random ^3.0.3 auto_approved
d3-geo-projection ^4.0.0 auto_approved
@types/d3-dispatch ^3.0.6 auto_approved
@types/d3-quadtree ^3.0.6 auto_approved
d3-scale-chromatic ^3.1.0 auto_approved
@types/d3-hierarchy ^3.1.7 auto_approved
@types/d3-interpolate ^3.0.4 auto_approved
@types/d3-scale-chromatic ^3.1.0 auto_approved

Dev Dependencies (5)

PackageConstraintRegistry Status
glob ^11.0.1 auto_approved
vitest ^3.0.2 auto_approved
@swc/core ^1.10.8 auto_approved
@types/bun latest auto_approved
typescript ^5.0.0 auto_approved

Transitive Dependency Tree

51 transitive deps max depth 3
  ├─ @types/d3-array ^3.2.1 → 3.2.2
  ├─ @types/d3-color ^3.1.3 → 3.1.3
  ├─ @types/d3-dispatch ^3.0.6 → 3.0.7
  ├─ @types/d3-dsv ^3.0.7 → 3.0.7
  ├─ @types/d3-ease ^3.0.2 → 3.0.2
  ├─ @types/d3-fetch ^3.0.7 → 3.0.7
  ├─ @types/d3-force ^3.0.10 → 3.0.10
  ├─ @types/d3-format ^3.0.4 → 3.0.4
  ├─ @types/d3-geo ^3.1.0 → 3.1.0
  ├─ @types/d3-hierarchy ^3.1.7 → 3.1.7
  ├─ @types/d3-interpolate ^3.0.4 → 3.0.4
  ├─ @types/d3-path ^3.1.0 → 3.1.1
  ├─ @types/d3-quadtree ^3.0.6 → 3.0.6
  ├─ @types/d3-random ^3.0.3 → 3.0.3
  ├─ @types/d3-scale ^4.0.9 → 4.0.9
  ├─ @types/d3-scale-chromatic ^3.1.0 → 3.1.0
  ├─ @types/d3-shape ^3.1.7 → 3.1.8
  ├─ @types/d3-time ^3.0.4 → 3.0.4
  ├─ @types/d3-timer ^3.0.2 → 3.0.2
  ├─ bun ^1.3.13 → 1.3.14
  ├─ d3-array ^3.2.4
  ├─ d3-color ^3.1.0 → 3.1.0
  ├─ d3-dispatch ^3.0.1 → 3.0.1
  ├─ d3-dsv ^3.0.1 → 3.0.1
  ├─ d3-ease ^3.0.1 → 3.0.1
  ├─ d3-fetch ^3.0.1 → 3.0.1
  ├─ d3-force ^3.0.0 → 3.0.0
  ├─ d3-force-3d ^3.0.5 → 3.0.6
  ├─ d3-format ^3.1.0 → 3.1.2
  ├─ d3-geo ^3.1.1 → 3.1.1
  ├─ d3-geo-projection ^4.0.0 → 4.0.0
  ├─ d3-hierarchy ^3.1.2 → 3.1.2
  ├─ d3-interpolate ^3.0.1 → 3.0.1
  ├─ d3-path ^3.1.0 → 3.1.0
  ├─ d3-quadtree ^3.0.1 → 3.0.1
  ├─ d3-random ^3.0.1 → 3.0.1
  ├─ d3-regression ^1.3.10 → 1.3.10
  ├─ d3-scale ^4.0.2 → 4.0.2
  ├─ d3-scale-chromatic ^3.1.0 → 3.1.0
  ├─ d3-shape ^3.2.0 → 3.2.0
  ├─ d3-time ^3.1.0 → 3.1.0
├─ d3-timer ^3.0.1 → 3.0.1
  ├─ @types/geojson * → 7946.0.16
  ├─ commander 7 → 7.2.0
  ├─ d3-binarytree 1 → 1.0.2
  ├─ d3-octree 1 → 1.1.0
  ├─ d3-time-format 2 - 4 → 4.1.0
  ├─ iconv-lite 0.6 → 0.6.3
├─ rw 1 → 1.3.3
  ├─ internmap 1 - 2 → 2.0.3
  ├─ safer-buffer >= 2.1.2 < 3.0.0 → 2.1.2

Changes from v1.0.11

Dependency Changes

ChangePackageVersion
added bun ^1.3.13

Script Changes

+ preinstall

File Changes

1 added 0 removed 1 modified size delta: +487.8 KB

Risk Dispositions (0 applicable to this version, 6 other)

Accepted rules are downgraded to INFO on future analyses; rejected rules escalate to CRITICAL.

Show 6 disposition(s) that do not match any finding on this version
Rule Source Disposition Author Reason
install-script:preinstall install-scripts reject AI AI (install-scripts): Malicious preinstall running obfuscated payload; generalizes to this package.
url-dep:@antv/setup npm-metadata reject AI AI (npm-metadata): SHA-pinned GitHub dep in optionalDependencies smuggling malicious payload.
obfuscated-file:index.js source-diff reject AI AI (source-diff): 498KB obfuscated file with crypto/env-spread; malware payload.
semgrep:obfuscation-while-true semgrep reject AI AI (semgrep): javascript-obfuscator output in malicious payload.
semgrep:obfuscation-hex-functions semgrep reject AI AI (semgrep): Hex function names from javascript-obfuscator in malicious payload.
semgrep:env-spread semgrep reject AI AI (semgrep): Captures all env secrets for exfiltration.

Review Summary

Risk score: 100 (capped from 406). Findings: 8 critical (+320), 2 high (+50), 3 medium (+30), 2 low (+6), 20 info (+0).

Published to npm: