← Home

echarts

npm Repository Homepage
2
Versions
—
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

langerrorrikwfsheepoviliaplainheartsusiwen8100pahapache-echartsjiawulin

Keywords

echartsdata-visualizationchartscharting-libraryvisualizationapachedata-vizcanvassvg

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff obfuscated-file:types/dist/all.d.ts AI (source-diff): TypeScript .d.ts barrel export with long re-export lines; not obfuscated code. ai
provenance publisher-changed AI (provenance): 100pah is a long-standing Apache/echarts maintainer (2026 days on npm). ai
dependencies unvetted-dep:zrender AI (dependencies): zrender is ECharts' own rendering engine maintained by the same Apache/ECharts team; it is a legitimate, expected dependency for every version of this package. ai
semgrep semgrep:new-function-constructor AI (semgrep): Usage is a legacy JSON.parse fallback pattern; JSON.parse is preferred and new Function is only reached in environments without it. Input is GeoJSON source, not arbitrary user input. ai

Versions (showing 2 of 2)

Version Deps Published
6.1.0 2 / 34
6.0.0 2 / 33

v6.1.0

3 findings
HIGH Publisher changed: ovilia → 100pah (on 2026-05-19) provenance

This version was published by a different npm account than previous versions on 2026-05-19. This could indicate a legitimate maintainer transition or an account compromise.

HIGH New obfuscated file: types/dist/all.d.ts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.