@antv/chartshaper (>=1.2.0-beta.0 <=1.2.0-beta.3), @antv/dipper-map (>=1.0.1 <=1.0.10) +14 more potentially affected by unknown CVE via @antv/l7-react (=2.4.3)

@antv/l7-react NPM version =2.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/l7-react and may be impacted: - @antv/chartshaper =1.2.0-beta.0, =1.0.1, =0.6.1, =2.3.70, =1.0.1, =1.0.0, =1.0.0, =1.0.2, =1.0.14 and more Source cves: unknown CVE...

@antv/f2-site (=5.0.0-alpha.1) potentially affected by unknown CVE via @antv/f2-react (=5.14.0)

@antv/f2-react NPM version =5.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/f2-react and may be impacted: - @antv/f2-site =5.0.0-alpha.1 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVF2REACT-16754975...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

@antv/ava (=3.6.0-alpha.0), @antv/g (>=6.0.0 <=6.2.1) +6 more potentially affected by unknown CVE via @antv/g-camera-api (>=2.0.0 <=2.0.9)

@antv/g-camera-api NPM version =2.0.0, =6.0.0, =0.5.9, =2.0.0, =1.2.5, =1.2.6 - expression-language-editor =0.0.4 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVGCAMERAAPI-16754825...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

@abtnode/ux (>=1.16.40 <=1.17.13-beta-20260512-042419-7b556a38), @ada-lc/echarts-materials (>=0.0.1 <=0.0.2) +501 more potentially affected by unknown CVE via echarts-for-react (>=3.0.0-beta.2 <=3.0.6)

echarts-for-react NPM version =3.0.0-beta.2, =1.16.40, =0.0.1, =0.1.0, =0.0.2-7.1, =0.1.1, =1.0.0, =0.1.0, =1.0.0, =1.0.0, =1.3.5-beta.937, =1.0.8-alpha, =3.34.0, =0.1.10, =1.0.5, =1.0.339 and more Source cves: unknown CVE Source advisory: SNYK:JS-ECHARTSFORREACT-16754865...

@antv/l7 (>=2.1.13 <=2.25.10), @antv/l7-draw (>=2.1.13 <=2.1.14) +6 more potentially affected by unknown CVE via @antv/l7-renderer (>=2.10.0 <=2.25.9)

@antv/l7-renderer NPM version =2.10.0, =2.1.13, =2.1.13, =2.10.0, =2.1.13, =2.1.13, =2.10.0, =1.0.0, =1.0.17, =1.0.18 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVL7RENDERER-16754403...

@antv/ava-react (>=3.0.0 <=3.3.2-beta.1), @antv/g2 (>=5.1.5 <=5.1.6-beta.1) +12 more potentially affected by unknown CVE via @antv/ava (>=3.0.0-alpha.0 <=3.4.1)

@antv/ava NPM version =3.0.0-alpha.0, =3.0.0, =5.1.5, =0.1.0, =1.0.0, =0.0.1-lb, =0.0.30, =0.0.0, =0.1.1, =1.1.1, =0.0.4, =0.0.1, =0.0.5 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVAVA-16754363...

@antv/l7 (=2.0.0-beta.5), @antv/l7-draw (>=2.1.13 <=2.1.14) +4 more potentially affected by unknown CVE via @antv/l7 (>=2.0.0-beta.4 <=2.25.9)

@antv/l7 NPM version =2.0.0-beta.4, =2.1.13, =2.1.13, =2.10.0, =1.0.0, =1.0.17, =1.0.18 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVL7-16755105...

@antv/chartshaper (>=1.2.0-beta.0 <=1.2.0-beta.3), @antv/dipper-map (>=1.0.1 <=1.0.10) +14 more potentially affected by unknown CVE via @antv/l7-react (=2.4.3)

@antv/l7-react NPM version =2.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/l7-react and may be impacted: - @antv/chartshaper =1.2.0-beta.0, =1.0.1, =0.6.1, =2.3.70, =1.0.1, =1.0.0, =1.0.0, =1.0.2, =1.0.14 and more Source cves: unknown CVE...

@lingxiteam/cli (=0.3.0), babel-preset-jaid (>=1.0.0 <=2.9.0) +1 more potentially affected by unknown CVE via babel-plugin-version (=0.2.3)

babel-plugin-version NPM version =0.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on babel-plugin-version and may be impacted: - @lingxiteam/cli =0.3.0 - babel-preset-jaid =1.0.0, =2.0.0, =2.9.0 Source cves: unknown CVE Source advisory:...

@antv/f2-react (>=5.0.19 <=5.14.0), @antv/f2-site (=5.0.0-alpha.1) potentially affected by unknown CVE via @antv/f-react (=1.10.0)

@antv/f-react NPM version =1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/f-react and may be impacted: - @antv/f2-react =5.0.19, =5.14.0 - @antv/f2-site =5.0.0-alpha.1 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVFREACT-16754957...

@antv/f-charts (=0.0.0), @antv/f2-my (=5.0.0-alpha.1) +6 more potentially affected by unknown CVE via @antv/f2 (>=5.0.28 <=5.14.0)

@antv/f2 NPM version =5.0.28, =5.0.0-alpha.1, =5.0.0-alpha.1, =5.0.1, =0.1.6, =0.9.5 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVF2-16754354...

@hocgin/ui (>=4.0.43 <=4.2.13), ame-miniapp-components (>=1.4.10-beta0 <=1.6.3-beta1) +5 more potentially affected by unknown CVE via react-adsense (=0.1.0)

react-adsense NPM version =0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on react-adsense and may be impacted: - @hocgin/ui =4.0.43, =1.4.10-beta0, =0.30.0, =2.0.3 - hello-tea-js =1.0.0 - jie-web =1.0.0 Source cves: unknown CVE Source advisory:...

@baloise/design-system-components (>=0.0.0 <=15.2.4), @baloise/design-system-components-angular (>=0.0.0-nightly-20230817143308 <=15.2.4) +27 more potentially affected by unknown CVE via filesize.js (=2.0.0)

filesize.js NPM version =2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on filesize.js and may be impacted: - @baloise/design-system-components =0.0.0, =0.0.0-nightly-20230817143308, =0.0.0, =0.0.0-nightly-20230817143308,...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

@0xsequence/checkout (>=0.0.0-20250314205219 <=5.2.4), @0xsequence/kit-checkout (>=0.0.0-20250305153405 <=4.6.6-beta.0) +190 more potentially affected by unknown CVE via timeago-react (>=3.0.2 <=3.0.7)

timeago-react NPM version =3.0.2, =0.0.0-20250314205219, =0.0.0-20250305153405, =1.0.0, =1.0.0, =0.5.4, =1.0.1, =2.0.10, =0.25.0, =0.23.0, =0.0.1, =1.0.7, =1.1.6 and more Source cves: unknown CVE Source advisory: SNYK:JS-TIMEAGOREACT-16755037...

@antv/f-engine (=0.0.2), @antv/f-my (=0.0.2) +3 more potentially affected by unknown CVE via @antv/g-css-layout-api (=1.0.38)

@antv/g-css-layout-api NPM version =1.0.38 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/g-css-layout-api and may be impacted: - @antv/f-engine =0.0.2 - @antv/f-my =0.0.2 - @antv/f-react =0.0.2 - @antv/f2-wx =0.0.2 - @antv/g =5.8.9, =5.16.33...

@agentscope-ai/chat (>=1.1.43 <=1.1.68-beta.1780902884191), @ant-design/charts (>=2.2.2 <=2.6.7) +62 more potentially affected by unknown CVE via @antv/g6-extension-react (>=0.1.19 <=0.2.7)

@antv/g6-extension-react NPM version =0.1.19, =1.1.43, =2.2.2, =2.0.0, =1.0.0, =0.1.0, =0.1.0, =1.2.0, =2.0.28, =0.0.18, =2.0.4, =0.0.2, =0.3.64, =0.7.0 - @jackiekim/my-component-library-test =0.1.2 and more Source cves: unknown CVE Source advisory: SNYK:JS-ANTVG6EXTENSIONREACT-16754797...

@ant-design/graphs (>=2.0.0 <=2.0.4), @antv/g6-extension-react (>=0.0.1 <=0.1.19) potentially affected by unknown CVE via @antv/react-g (=2.1.1)

@antv/react-g NPM version =2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/react-g and may be impacted: - @ant-design/graphs =2.0.0, =0.0.1, =0.1.19 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVREACTG-16755026...