@bixiao/common-menu-links (>=1.0.9 <=2.3.24), @bixiao/ui (>=1.2.6 <=2.3.24) +20 more potentially affected by unknown CVE via onfire.js (=2.0.1)

onfire.js NPM version =2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on onfire.js and may be impacted: - @bixiao/common-menu-links =1.0.9, =1.2.6, =1.0.6, =1.0.6, =2.0.42, =1.0.9, =2.1.12, =1.0.1, =1.2.3, =1.0.3, =1.0.1, =1.1.0, =0.0.1-beta.1,...

@appthen/x6-plugins (=0.1.4), @arch-diagram/core (>=0.0.1 <=0.0.2) +50 more potentially affected by unknown CVE via @antv/x6-plugin-stencil (>=2.0.2 <=2.1.5)

@antv/x6-plugin-stencil NPM version =2.0.2, =0.0.1, =0.0.2, =0.0.3, =0.0.1, =0.0.3, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.17 - @xrhcc-flow/busiflow =1.0.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-ANTVX6PLUGINSTENCIL-16754383...

@2nova/wu-ui (>=1.1.0 <=1.3.12), @action.sustainability/storybook-dashboard (>=0.1.1 <=0.1.5) +824 more potentially affected by unknown CVE via @antv/color-util (=2.0.6)

@antv/color-util NPM version =2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/color-util and may be impacted: - @2nova/wu-ui =1.1.0, =0.1.1, =0.1.1, =0.1.0, =0.0.2, =0.1.2, =1.0.0, =1.1.15, =1.0.4, =0.1.5, =1.0.0, =0.0.1, =1.0.2,...

4house-libts-places-autocomplete (=1.0.0), @77sol-ui/atoms (>=5.1.0 <=5.4.0) +267 more potentially affected by unknown CVE via jest-canvas-mock (>=2.0.0-beta.1 <=2.5.2)

jest-canvas-mock NPM version =2.0.0-beta.1, =5.1.0, =1.0.1, =1.0.0, =1.0.0, =0.0.0, =0.0.1-react-native, =2.1.0-alpha.0, =2.1.0-alpha.0, =2.1.0-alpha.0, =2.1.0-alpha.250, =2.1.0-alpha.250, =0.0.5, =0.0.6, =0.3.113, =0.5.0 and more Source cves: unknown CVE Source advisory:...

@glorysoft/mcs_tool (>=0.0.25 <=0.0.28), @ithinkdt/lowcode (>=4.0.0 <=4.0.5) +15 more potentially affected by unknown CVE via @antv/x6 (=3.1.7)

@antv/x6 NPM version =3.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/x6 and may be impacted: - @glorysoft/mcstool =0.0.25, =4.0.0, =2.0.0, =0.7.0, =0.7.0, =0.14.0, =0.0.1, =1.0.0, =1.0.0, =0.0.1, =0.1.8 and more Source cves: unknown CVE...

@bixiao/common-menu-links (>=1.0.9 <=2.3.24), @bixiao/ui (>=1.2.6 <=2.3.24) +20 more potentially affected by unknown CVE via onfire.js (=2.0.1)

onfire.js NPM version =2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on onfire.js and may be impacted: - @bixiao/common-menu-links =1.0.9, =1.2.6, =1.0.6, =1.0.6, =2.0.42, =1.0.9, =2.1.12, =1.0.1, =1.2.3, =1.0.3, =1.0.1, =1.1.0, =0.0.1-beta.1,...

1byte-react-design (>=1.7.1 <=1.14.0), @aaf-comp/graph-widget (>=1.0.0 <=1.0.3) +314 more potentially affected by unknown CVE via @antv/vendor (>=1.0.11 <=1.0.6)

@antv/vendor NPM version =1.0.11, =1.7.1, =1.0.0, =1.1.43, =5.0.48, =1.0.1, =1.0.4, =2.0.0, =2.0.0, =1.0.0, =2.0.0, =3.0.3, =3.0.0, =2.0.0, =0.5.6, =6.1.21, =6.3.1 and more Source cves: unknown CVE Source advisory: SNYK:JS-ANTVVENDOR-16754350...

@abtnode/ux (>=1.16.40 <=1.17.13-beta-20260512-042419-7b556a38), @ada-lc/echarts-materials (>=0.0.1 <=0.0.2) +501 more potentially affected by unknown CVE via echarts-for-react (>=3.0.0-beta.2 <=3.0.6)

echarts-for-react NPM version =3.0.0-beta.2, =1.16.40, =0.0.1, =0.1.0, =0.0.2-7.1, =0.1.1, =1.0.0, =0.1.0, =1.0.0, =1.0.0, =1.3.5-beta.937, =1.0.8-alpha, =3.34.0, =0.1.10, =1.0.5, =1.0.339 and more Source cves: unknown CVE Source advisory: SNYK:JS-ECHARTSFORREACT-16755035...

@action.sustainability/storybook-dashboard (>=0.1.1 <=0.1.5), @ada-lc/fusion-materials (>=0.1.1 <=0.1.3) +565 more potentially affected by unknown CVE via @antv/g2plot (>=2.2.13 <=2.4.8)

@antv/g2plot NPM version =2.2.13, =0.1.1, =0.1.1, =0.1.0, =0.0.2, =0.1.2, =1.1.15, =1.0.4, =0.1.5, =1.0.0, =0.0.1, =1.0.2, =1.0.0-alpha.1, =1.0.3, =1.1.4, =1.1.6-alpha.1 and more Source cves: unknown CVE Source advisory: SNYK:JS-ANTVG2PLOT-16754352...

@antv/f-my (>=0.0.1 <=1.6.0), @antv/f2-my (>=4.0.0 <=5.0.0-alpha.1) +13 more potentially affected by unknown CVE via @antv/f2-context (>=0.0.0 <=0.0.1)

@antv/f2-context NPM version =0.0.0, =0.0.1, =4.0.0, =2.0.0, =0.1.0, =0.3.1, =0.3.1, =1.0.0, =1.1.0, =1.0.0, =1.0.1 - qn-pc-f2 =0.1.2 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVF2CONTEXT-16754917...

@action.sustainability/storybook-dashboard (>=0.1.1 <=0.1.5), @aliedu/vc-edu-components (>=1.1.15 <=1.1.24) +404 more potentially affected by unknown CVE via @antv/path-util (=3.0.1)

@antv/path-util NPM version =3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/path-util and may be impacted: - @action.sustainability/storybook-dashboard =0.1.1, =1.1.15, =0.1.0, =0.9.4-beta1, =0.0.1-beta.1, =0.0.1, =3.0.0, =3.0.0, =1.0.0,...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

@aidps/canvas-flow (>=1.0.0 <=1.0.1), @antv/xflow (>=2.0.1 <=2.2.4) +116 more potentially affected by unknown CVE via @antv/x6-plugin-selection (>=2.0.0 <=2.2.2)

@antv/x6-plugin-selection NPM version =2.0.0, =1.0.0, =2.0.1, =0.0.1, =0.0.2, =1.0.0-beta.46, =0.0.4, =0.7.0, =0.0.3, =2.0.4, =0.0.27, =3.0.0, =4.0.0-600 and more Source cves: unknown CVE Source advisory: SNYK:JS-ANTVX6PLUGINSELECTION-16755096...

1byte-react-design (>=1.7.1 <=1.14.0), @aaf-comp/graph-widget (>=1.0.0 <=1.0.3) +246 more potentially affected by unknown CVE via @antv/g-plugin-dragndrop (>=2.0.0 <=2.1.1)

@antv/g-plugin-dragndrop NPM version =2.0.0, =1.7.1, =1.0.0, =1.1.43, =5.0.48, =1.0.1, =2.0.0, =2.0.0, =1.0.0, =2.0.0, =3.0.3, =3.0.0, =0.5.6, =1.0.0, =1.0.0, =1.0.0, =1.1.1 and more Source cves: unknown CVE Source advisory: SNYK:JS-ANTVGPLUGINDRAGNDROP-16754940...

@action.sustainability/storybook-dashboard (>=0.1.1 <=0.1.5), @agentlab/ldkg-ui-charts (>=0.1.4 <=0.1.7) +172 more potentially affected by unknown CVE via @antv/xflow-hook (>=1.0.0 <=1.1.52)

@antv/xflow-hook NPM version =1.0.0, =0.1.1, =0.1.4, =1.1.15, =0.1.0, =1.3.0, =1.0.1, =1.0.0, =1.0.0, =1.0.0, =0.0.0, =1.0.0, =1.0.0, =0.2.0, =0.2.1 and more Source cves: unknown CVE Source advisory: SNYK:JS-ANTVXFLOWHOOK-16755077...

@antv/g-web-components (>=2.0.0 <=2.1.1), @antv/g6-extension-3d (>=0.1.0 <=0.1.23) +1 more potentially affected by unknown CVE via @antv/g-webgl (>=2.0.0 <=2.1.1)

@antv/g-webgl NPM version =2.0.0, =2.0.0, =0.1.0, =1.0.2, =1.0.8 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVGWEBGL-16754845...

@antv/l7 (>=2.1.13 <=2.25.10), @antv/l7-component (>=2.21.4 <=2.25.10) +8 more potentially affected by unknown CVE via @antv/l7-source (>=2.10.0 <=2.25.9)

@antv/l7-source NPM version =2.10.0, =2.1.13, =2.21.4, =2.1.13, =2.1.13, =2.10.0, =2.1.13, =2.10.0, =2.10.0, =1.0.0, =1.0.17, =1.0.18 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVL7SOURCE-16754469...

@action.sustainability/storybook-dashboard (>=0.1.1 <=0.1.5), @agentlab/ldkg-ui-charts (>=0.1.4 <=0.1.7) +168 more potentially affected by unknown CVE via @antv/xflow-core (>=1.0.0 <=1.1.52)

@antv/xflow-core NPM version =1.0.0, =0.1.1, =0.1.4, =1.1.15, =0.1.0, =1.3.0, =1.0.1, =1.0.0, =1.0.0, =0.0.0, =1.0.0, =1.0.0, =0.2.0, =1.1.0, =1.6.6 and more Source cves: unknown CVE Source advisory: SNYK:JS-ANTVXFLOWCORE-16754364...

@antv/auto-chart (>=2.0.0 <=2.1.0-alpha.0), @antv/chart-advisor (>=2.0.0 <=2.1.0-alpha.1) +5 more potentially affected by unknown CVE via @antv/ckb (>=2.0.4 <=2.1.0-alpha.0)

@antv/ckb NPM version =2.0.4, =2.0.0, =2.0.0, =1.2.0-beta.0, =1.0.0-alpha.1, =2.0.0, =2.0.0, =0.0.1, =0.1.0-beta.57 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVCKB-16754938...

@21epub/matomo-echarts-components (>=0.1.0 <=0.1.21), @abtnode/ux (>=1.16.40 <=1.17.13-beta-20260512-042419-7b556a38) +1361 more potentially affected by unknown CVE via size-sensor (>=1.0.1 <=1.0.3)

size-sensor NPM version =1.0.1, =0.1.0, =1.16.40, =0.1.1, =0.0.1, =0.1.1, =0.1.0, =0.0.2, =0.26.6, =0.1.2, =0.0.3, =0.1.0, =0.0.2-7.1, =1.1.15, =1.1.24 and more Source cves: unknown CVE Source advisory: SNYK:JS-SIZESENSOR-16755015...