All @antv/x6-plugin-dnd versions

@antv/[email protected] rejected Risk: 100 No license

@antv/x6-plugin-dnd @2.2.1

rejected
This version was rejected. It did not pass GreenFlagged's security review and is not served by the registry. The findings and risk dispositions below explain why.
npm Repository Homepage Tarball
100
Risk Score
—
License
Yes
Install Scripts
0
Dependencies
1
Dev Dependencies
189.2 KB
Package Size
Published

Maintainers

lviseifreestyle21soundquietelaine.q.10sturubysakuya223serializedowenxdzhaoyangzhanmeiwjgogogoleungwensendoriiaaronyardsimaqdxq613intchoussusan_annjinke.lilzxuearmy8735atoolbaizndengfupingneoddishjeffy2012zqluafc163pomelo-nwukopiluwakyccnuzindexpanyuqibubkoozengyuekasmineboyu.zljl1ud0ngq1newbyvectorwinniexingchenlulikn9117xdddstsemious2020esoranadia_liubbsqqmxz96102openwaynepearminipddpdyiqianyaozhanbacxxxxxnlaixingui.lxgsusiwen8yanxiongzeyuwangrainy25ghzzhangjunjie-lokiflash1yisi.wangdreammy23biupiubiupiubasketduckxuying1027banxuanpearl_wangbqxbqxbqxalex_zjtduxinyue023wang1212leondt1gaofuhong

Keywords

plugindndx6antv

Dev Dependencies (1)

PackageConstraintRegistry Status
@antv/x6 ^2.x auto_approved

Changes from v2.1.1

Dependency Changes

Script Changes

+ preinstall

File Changes

1 added 0 removed 1 modified size delta: +486.9 KB

Risk Dispositions (0 applicable to this version, 5 other)

Accepted rules are downgraded to INFO on future analyses; rejected rules escalate to CRITICAL.

Show 5 disposition(s) that do not match any finding on this version
Rule Source Disposition Author Reason
install-script:preinstall install-scripts reject AI AI (install-scripts): Executes obfuscated index.js payload on install; clear malware delivery mechanism.
url-dep:@antv/setup npm-metadata reject AI AI (npm-metadata): SHA-pinned GitHub optionalDep used to smuggle payload; matches known attack pattern.
publisher-changed provenance reject AI AI (provenance): Publisher change coincides with malicious payload injection; account compromise or takeover.
obfuscated-file:index.js source-diff reject AI AI (source-diff): Newly added obfuscated 498KB file is the malicious payload executed by preinstall.
dormant-publish publish-pattern reject AI AI (publish-pattern): 972-day dormancy followed by malicious publish; consistent with account takeover.

Review Summary

Risk score: 100 (capped from 258). Findings: 9 high (+225), 3 medium (+30), 1 low (+3).

Published to npm: