All @antv/g2 versions

@antv/[email protected] rejected Risk: 100 No license

@antv/g2 @5.5.8

rejected
This version was rejected. It did not pass GreenFlagged's security review and is not served by the registry. The findings and risk dispositions below explain why.
npm Repository Tarball
100
Risk Score
—
License
Yes
Install Scripts
12
Dependencies
49
Dev Dependencies
2252.5 KB
Package Size
Published

Maintainers

lviseifreestyle21soundquietelaine.q.10sturubysakuya223serializedowenxdzhaoyangzhanmeiwjgogogoleungwensendoriiaaronyardsimaqdxq613intchoussusan_annjinke.lilzxuearmy8735atoolbaizndengfupingneoddishjeffy2012zqluafc163pomelo-nwukopiluwakyccnuzindexpanyuqibubkoozengyuekasmineboyu.zljl1ud0ngq1newbyvectorwinniexingchenlulikn9117xdddstsemious2020esoranadia_liubbsqqmxz96102openwaynepearminipddpdyiqianyaozhanbacxxxxxnlaixingui.lxgsusiwen8yanxiongzeyuwangrainy25ghzzhangjunjie-lokiflash1yisi.wangdreammy23biupiubiupiubasketduckxuying1027banxuanpearl_wangbqxbqxbqxalex_zjtduxinyue023wang1212leondt1gaofuhongxcf(-_-)boyyangzaisiqisheninterstellarmtmoayuisuda

Keywords

antvg2visualizationchartgrammargraphicsinteractionanimation

Dependencies (12)

PackageConstraintRegistry Status
flru ^1.0.2 auto_approved
pdfast ^0.2.0 auto_approved
@antv/g ^6.1.24 auto_approved
@antv/expr ^1.0.2 auto_approved
@antv/util ^3.3.10 auto_approved
@antv/coord ^0.4.7 auto_approved
@antv/scale ^0.5.1 auto_approved
@antv/vendor ^1.0.11 auto_approved
@antv/g-canvas ^2.0.43 auto_approved
@antv/component ^2.1.9 auto_approved
@antv/event-emitter ^0.1.3 auto_approved
@antv/g-plugin-dragndrop ^2.0.35 auto_approved

Dev Dependencies (49)

PackageConstraintRegistry Status
svgo ^3.3.2 auto_approved
vite ^4.5.14 No greenflagged match
fecha ^4.2.3 auto_approved
husky ^7.0.4 auto_approved
jsdom ^20 auto_approved
tslib ^2.8.1 auto_approved
eslint ^7.32.0 auto_approved
rimraf ^3.0.2 auto_approved
rollup ^2.79.2 auto_approved
vitest ^3.1.4 No greenflagged match
prettier ^2.8.8 auto_approved
cross-env ^7.0.3 auto_approved
limit-size ^0.1.4 Not imported
pixelmatch 5.3.0 auto_approved
typescript ^5.0.0 auto_approved
@antv/g-svg ^2.0.38 auto_approved
@types/diff ^5.2.3 auto_approved
lint-staged ^10.5.4 auto_approved
npm-run-all ^4.1.5 auto_approved
@antv/g-webgl ^2.0.47 Not imported
xmlserializer ^0.6.1 auto_approved
@antv/data-set ^0.11.8 auto_approved
@antv/g-pattern ^2.0.35 Not imported
@commitlint/cli ^11.0.0 No greenflagged match
topojson-client ^3.1.0 auto_approved
@antv/translator ^1.0.1 Not imported
@antv/g-plugin-3d ^2.0.45 Not imported
@types/pixelmatch ^5.2.6 Not imported
@rollup/plugin-json ^6.1.0 auto_approved
eslint-plugin-import ^2.31.0 auto_approved
@antv/g2-extension-3d ^0.1.6 Not imported
@rollup/plugin-terser ^0.4.4 auto_approved
@antv/g-plugin-control ^2.0.34 Not imported
@antv/g2-extension-ava ^0.1.1 Not imported
@types/topojson-client ^3.1.5 auto_approved
@antv/g2-extension-plot ^0.1.2 No greenflagged match
@rollup/plugin-commonjs ^21.1.0 auto_approved
rollup-plugin-visualizer ^5.14.0 auto_approved
@typescript-eslint/parser ^4.33.0 auto_approved
@vitest/coverage-istanbul ^3.1.4 No greenflagged match
rollup-plugin-typescript2 ^0.35.0 auto_approved
conventional-changelog-cli ^2.2.2 auto_approved
@rollup/plugin-node-resolve ^15.3.1 auto_approved
rollup-plugin-polyfill-node ^0.8.0 No greenflagged match
@optimize-lodash/rollup-plugin ^4.0.4 No greenflagged match
@commitlint/config-conventional ^17.8.1 No greenflagged match
@typescript-eslint/eslint-plugin ^4.33.0 auto_approved
@antv/g-plugin-rough-svg-renderer ^2.0.38 Not imported
@antv/g-plugin-rough-canvas-renderer ^2.0.42 auto_approved

Transitive Dependency Tree

75 transitive deps max depth 8
  ├─ @antv/component ^2.1.9 → 2.1.11
  ├─ @antv/coord ^0.4.7 → 0.4.7
  ├─ @antv/event-emitter ^0.1.3 → 0.1.3
  ├─ @antv/expr ^1.0.2 → 1.0.2
  ├─ @antv/g ^6.1.24 → 6.3.1
  ├─ @antv/g-canvas ^2.0.43 → 2.2.0
  ├─ @antv/g-plugin-dragndrop ^2.0.35 → 2.1.1
  ├─ @antv/scale ^0.5.1 → 0.5.2
  ├─ @antv/util ^3.3.10 → 3.3.11
  ├─ @antv/vendor ^1.0.11 → 1.0.11
  ├─ flru ^1.0.2 → 1.0.2
├─ pdfast ^0.2.0 → 0.2.0
  ├─ @antv/g ^6.1.11 → 6.3.1
  ├─ @antv/g-lite 2.7.0 → 2.7.0
  ├─ @antv/g-math 3.1.0 → 3.1.0
  ├─ @antv/scale ^0.4.16
  ├─ @antv/scale ^0.4.12
  ├─ @antv/util ^3.3.7 → 3.3.11
  ├─ @antv/util ^3.3.10 → 3.3.11
  ├─ @antv/util ^2.0.13
  ├─ @antv/util ^3.3.5 → 3.3.11
  ├─ @babel/runtime ^7.25.6 → 7.29.7
  ├─ @types/d3-array ^3.2.1 → 3.2.2
  ├─ @types/d3-color ^3.1.3 → 3.1.3
  ├─ @types/d3-dispatch ^3.0.6 → 3.0.7
  ├─ @types/d3-dsv ^3.0.7 → 3.0.7
  ├─ @types/d3-ease ^3.0.2 → 3.0.2
  ├─ @types/d3-fetch ^3.0.7 → 3.0.7
  ├─ @types/d3-force ^3.0.10 → 3.0.10
  ├─ @types/d3-format ^3.0.4 → 3.0.4
  ├─ @types/d3-geo ^3.1.0 → 3.1.0
  ├─ @types/d3-hierarchy ^3.1.7 → 3.1.7
  ├─ @types/d3-interpolate ^3.0.4 → 3.0.4
  ├─ @types/d3-path ^3.1.0 → 3.1.1
  ├─ @types/d3-quadtree ^3.0.6 → 3.0.6
  ├─ @types/d3-random ^3.0.3 → 3.0.3
  ├─ @types/d3-scale ^4.0.9 → 4.0.9
  ├─ @types/d3-scale-chromatic ^3.1.0 → 3.1.0
  ├─ @types/d3-shape ^3.1.7 → 3.1.8
  ├─ @types/d3-time ^3.0.4 → 3.0.4
  ├─ @types/d3-timer ^3.0.2 → 3.0.2
  ├─ color-string ^1.5.5 → 1.9.1
  ├─ d3-array ^3.2.4
  ├─ d3-color ^3.1.0 → 3.1.0
  ├─ d3-dispatch ^3.0.1 → 3.0.1
  ├─ d3-dsv ^3.0.1 → 3.0.1
  ├─ d3-ease ^3.0.1 → 3.0.1
  ├─ d3-fetch ^3.0.1 → 3.0.1
  ├─ d3-force ^3.0.0 → 3.0.0
  ├─ d3-force-3d ^3.0.5 → 3.0.6
  ├─ d3-format ^3.1.0 → 3.1.2
  ├─ d3-geo ^3.1.1 → 3.1.1
  ├─ d3-geo-projection ^4.0.0 → 4.0.0
  ├─ d3-hierarchy ^3.1.2 → 3.1.2
  ├─ d3-interpolate ^3.0.1 → 3.0.1
  ├─ d3-path ^3.1.0 → 3.1.0
  ├─ d3-quadtree ^3.0.1 → 3.0.1
  ├─ d3-random ^3.0.1 → 3.0.1
  ├─ d3-regression ^1.3.10 → 1.3.10
  ├─ d3-scale ^4.0.2 → 4.0.2
  ├─ d3-scale-chromatic ^3.1.0 → 3.1.0
  ├─ d3-shape ^3.2.0 → 3.2.0
  ├─ d3-time ^3.1.0 → 3.1.0
  ├─ d3-timer ^3.0.1 → 3.0.1
  ├─ fast-deep-equal ^3.1.3 → 3.1.3
  ├─ fecha ^4.2.1 → 4.2.3
  ├─ gl-matrix ^3.4.3 → 3.4.4
  ├─ gl-matrix ^3.3.0 → 3.4.4
  ├─ html2canvas ^1.4.1 → 1.4.1
  ├─ tslib ^2.3.1 → 2.8.1
├─ tslib ^2.5.3 → 2.8.1
  ├─ @antv/g-math 3.1.0 → 3.1.0
  ├─ @antv/util ^3.3.5 → 3.3.11
  ├─ @antv/vendor ^1.0.3 → 1.0.11
  ├─ @babel/runtime ^7.25.6 → 7.29.7
  ├─ @types/d3-color * → 3.1.3
  ├─ @types/d3-dsv * → 3.0.7
  ├─ @types/d3-path * → 3.1.1
  ├─ @types/d3-time * → 3.0.4
  ├─ @types/geojson * → 7946.0.16
  ├─ color-name ^1.0.0 → 1.1.4
  ├─ commander 7 → 7.2.0
  ├─ d3-array 1 - 3 → 3.2.3
  ├─ d3-array 2.5.0 - 3 → 3.2.3
  ├─ d3-array 2.10.0 - 3 → 3.2.3
  ├─ d3-array 2 - 3 → 3.2.3
  ├─ d3-binarytree 1 → 1.0.2
  ├─ d3-color 1 - 3 → 3.1.0
  ├─ d3-dispatch 1 - 3 → 3.0.1
  ├─ d3-dsv 1 - 3 → 3.0.1
  ├─ d3-format 1 - 3 → 3.1.2
  ├─ d3-geo 1.12.0 - 3 → 3.1.1
  ├─ d3-interpolate 1.2.0 - 3 → 3.0.1
  ├─ d3-interpolate 1 - 3 → 3.0.1
  ├─ d3-octree 1 → 1.1.0
  ├─ d3-path ^3.1.0 → 3.1.0
  ├─ d3-quadtree 1 - 3 → 3.0.1
  ├─ d3-time 2.1.1 - 3 → 3.1.0
  ├─ d3-time-format 2 - 4 → 4.1.0
  ├─ d3-timer 1 - 3 → 3.0.1
  ├─ eventemitter3 ^5.0.1 → 5.0.4
  ├─ fast-deep-equal ^3.1.3 → 3.1.3
  ├─ gl-matrix ^3.3.0 → 3.4.4
  ├─ gl-matrix ^3.4.3 → 3.4.4
  ├─ html2canvas ^1.4.1 → 1.4.1
  ├─ iconv-lite 0.6 → 0.6.3
  ├─ rw 1 → 1.3.3
  ├─ simple-swizzle ^0.2.2 → 0.2.4
  ├─ tslib ^2.3.1 → 2.8.1
├─ tslib ^2.5.3 → 2.8.1
  ├─ @antv/util ^3.3.5 → 3.3.11
  ├─ @babel/runtime ^7.25.6 → 7.29.7
  ├─ @types/d3-array ^3.2.1 → 3.2.2
  ├─ @types/d3-color ^3.1.3 → 3.1.3
  ├─ @types/d3-dispatch ^3.0.6 → 3.0.7
  ├─ @types/d3-dsv ^3.0.7 → 3.0.7
  ├─ @types/d3-ease ^3.0.2 → 3.0.2
  ├─ @types/d3-fetch ^3.0.7 → 3.0.7
  ├─ @types/d3-force ^3.0.10 → 3.0.10
  ├─ @types/d3-format ^3.0.4 → 3.0.4
  ├─ @types/d3-geo ^3.1.0 → 3.1.0
  ├─ @types/d3-hierarchy ^3.1.7 → 3.1.7
  ├─ @types/d3-interpolate ^3.0.4 → 3.0.4
  ├─ @types/d3-path ^3.1.0 → 3.1.1
  ├─ @types/d3-quadtree ^3.0.6 → 3.0.6
  ├─ @types/d3-random ^3.0.3 → 3.0.3
  ├─ @types/d3-scale ^4.0.9 → 4.0.9
  ├─ @types/d3-scale-chromatic ^3.1.0 → 3.1.0
  ├─ @types/d3-shape ^3.1.7 → 3.1.8
  ├─ @types/d3-time ^3.0.4 → 3.0.4
  ├─ @types/d3-timer ^3.0.2 → 3.0.2
  ├─ commander 7 → 7.2.0
  ├─ d3-array 2 - 3 → 3.2.3
  ├─ d3-array 2.5.0 - 3 → 3.2.3
  ├─ d3-array ^3.2.4
  ├─ d3-color 1 - 3 → 3.1.0
  ├─ d3-color ^3.1.0 → 3.1.0
  ├─ d3-dispatch ^3.0.1 → 3.0.1
  ├─ d3-dsv ^3.0.1 → 3.0.1
  ├─ d3-ease ^3.0.1 → 3.0.1
  ├─ d3-fetch ^3.0.1 → 3.0.1
  ├─ d3-force ^3.0.0 → 3.0.0
  ├─ d3-force-3d ^3.0.5 → 3.0.6
  ├─ d3-format ^3.1.0 → 3.1.2
  ├─ d3-geo ^3.1.1 → 3.1.1
  ├─ d3-geo-projection ^4.0.0 → 4.0.0
  ├─ d3-hierarchy ^3.1.2 → 3.1.2
  ├─ d3-interpolate ^3.0.1 → 3.0.1
  ├─ d3-path ^3.1.0 → 3.1.0
  ├─ d3-quadtree ^3.0.1 → 3.0.1
  ├─ d3-random ^3.0.1 → 3.0.1
  ├─ d3-regression ^1.3.10 → 1.3.10
  ├─ d3-scale ^4.0.2 → 4.0.2
  ├─ d3-scale-chromatic ^3.1.0 → 3.1.0
  ├─ d3-shape ^3.2.0 → 3.2.0
  ├─ d3-time 1 - 3 → 3.1.0
  ├─ d3-time ^3.1.0 → 3.1.0
  ├─ d3-timer ^3.0.1 → 3.0.1
  ├─ fast-deep-equal ^3.1.3 → 3.1.3
  ├─ gl-matrix ^3.3.0 → 3.4.4
  ├─ gl-matrix ^3.4.3 → 3.4.4
  ├─ iconv-lite 0.6 → 0.6.3
  ├─ internmap 1 - 2 → 2.0.3
  ├─ is-arrayish ^0.3.1
  ├─ rw 1 → 1.3.3
  ├─ safer-buffer >= 2.1.2 < 3.0.0 → 2.1.2
  ├─ tslib ^2.5.3 → 2.8.1
├─ tslib ^2.3.1 → 2.8.1
  ├─ @types/d3-color * → 3.1.3
  ├─ @types/d3-dsv * → 3.0.7
  ├─ @types/d3-path * → 3.1.1
  ├─ @types/d3-time * → 3.0.4
  ├─ @types/geojson * → 7946.0.16
  ├─ commander 7 → 7.2.0
  ├─ d3-array 1 - 3 → 3.2.3
  ├─ d3-array 2 - 3 → 3.2.3
  ├─ d3-array 2.5.0 - 3 → 3.2.3
  ├─ d3-array 2.10.0 - 3 → 3.2.3
  ├─ d3-binarytree 1 → 1.0.2
  ├─ d3-color 1 - 3 → 3.1.0
  ├─ d3-dispatch 1 - 3 → 3.0.1
  ├─ d3-dsv 1 - 3 → 3.0.1
  ├─ d3-format 1 - 3 → 3.1.2
  ├─ d3-geo 1.12.0 - 3 → 3.1.1
  ├─ d3-interpolate 1.2.0 - 3 → 3.0.1
  ├─ d3-interpolate 1 - 3 → 3.0.1
  ├─ d3-octree 1 → 1.1.0
  ├─ d3-path ^3.1.0 → 3.1.0
  ├─ d3-quadtree 1 - 3 → 3.0.1
  ├─ d3-time 2.1.1 - 3 → 3.1.0
  ├─ d3-time-format 2 - 4 → 4.1.0
  ├─ d3-timer 1 - 3 → 3.0.1
  ├─ fast-deep-equal ^3.1.3 → 3.1.3
  ├─ gl-matrix ^3.3.0 → 3.4.4
  ├─ iconv-lite 0.6 → 0.6.3
  ├─ internmap 1 - 2 → 2.0.3
  ├─ rw 1 → 1.3.3
  ├─ safer-buffer >= 2.1.2 < 3.0.0 → 2.1.2
├─ tslib ^2.3.1 → 2.8.1
  ├─ commander 7 → 7.2.0
  ├─ d3-array 2.5.0 - 3 → 3.2.3
  ├─ d3-array 2 - 3 → 3.2.3
  ├─ d3-color 1 - 3 → 3.1.0
  ├─ d3-time 1 - 3 → 3.1.0
  ├─ iconv-lite 0.6 → 0.6.3
  ├─ internmap 1 - 2 → 2.0.3
  ├─ rw 1 → 1.3.3
├─ safer-buffer >= 2.1.2 < 3.0.0 → 2.1.2
  ├─ d3-array 2 - 3 → 3.2.3
  ├─ internmap 1 - 2 → 2.0.3
├─ safer-buffer >= 2.1.2 < 3.0.0 → 2.1.2
  ├─ internmap 1 - 2 → 2.0.3

Changes from v5.4.8

Dependency Changes

Script Changes

+ preinstall

File Changes

1 added 0 removed 1 modified size delta: +486.9 KB

Risk Dispositions (3 applicable to this version, 0 other)

Accepted rules are downgraded to INFO on future analyses; rejected rules escalate to CRITICAL.

Rule Source Disposition Author Reason
install-script:preinstall install-scripts reject AI AI (install-scripts): Malicious preinstall running obfuscated index.js; not part of legitimate @antv/g2 build.
obfuscated-file:index.js source-diff reject AI AI (source-diff): 498KB javascript-obfuscator output with env-spread; payload of supply-chain attack.
url-dep:@antv/setup npm-metadata reject AI AI (npm-metadata): SHA-pinned GitHub dep in optionalDependencies is attack infrastructure.

SAST Findings (11)

HIGH Package has 'preinstall' script install-scripts

Script: bun run index.js

HIGH SHA-pinned github dependency (optionalDependencies): @antv/setup npm-metadata

Dependency '@antv/setup' in `optionalDependencies` points to 'github:antvis/G2#1916faa365f2788b6e193514872d51a242876569' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atool.

HIGH Publisher changed: moayuisuda → atool (on 2026-05-19) provenance

This version was published by a different npm account than previous versions on 2026-05-19. This could indicate a legitimate maintainer transition or an account compromise.

HIGH New obfuscated file: index.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH obfuscation-while-true: index.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | const _0x5d6bea=_0x1169;(function(_0x3187cf,_0x895a8e){const _0x5f2282={_0x2bb395:0x3eb,_0x56f5b5:0x6c1,_0x24d254:0x85d,

HIGH obfuscation-hex-functions: index.js:1 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator > 1 | const _0x5d6bea=_0x1169;(function(_0x3187cf,_0x895a8e){const _0x5f2282={_0x2bb395:0x3eb,_0x56f5b5:0x6c1,_0x24d254:0x85d,

HIGH obfuscation-hex-functions: index.js:1 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator > 1 | const _0x5d6bea=_0x1169;(function(_0x3187cf,_0x895a8e){const _0x5f2282={_0x2bb395:0x3eb,_0x56f5b5:0x6c1,_0x24d254:0x85d,

HIGH env-spread: index.js:1 semgrep

Spreading entire process.env into an object — may capture all secrets > 1 | const _0x5d6bea=_0x1169;(function(_0x3187cf,_0x895a8e){const _0x5f2282={_0x2bb395:0x3eb,_0x56f5b5:0x6c1,_0x24d254:0x85d,

HIGH obfuscation-hex-functions: index.js:1 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator > 1 | const _0x5d6bea=_0x1169;(function(_0x3187cf,_0x895a8e){const _0x5f2282={_0x2bb395:0x3eb,_0x56f5b5:0x6c1,_0x24d254:0x85d,

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Review Summary

Risk score: 100 (capped from 273). Findings: 10 high (+250), 2 medium (+20), 1 low (+3).

Published to npm: