dash-ant-design
A dash component library based on ant design
This report shows the evidence for dash-ant-design@0.1.1. 1 of 3 known versions is blocked or flagged. The newest version, 0.1.2, is allowed. See all versions.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe manifest confirms the dependency and exact version flagged as malicious. This dependency insertion is sufficient to block publication; the dependency source was unavailable to establish its behavior in more detail.
Decision evidence
public snapshot- The manifest declares lodash 4.18.1 as a runtime dependency; dependency intelligence flagged this exact version as malicious.
- The package describes itself as a Dash component library and has no install lifecycle hook in its scripts.
- The Socket.IO component creates a connection from component props, so its network activity is configurable application behavior.
Source & flagged code
5 flaggedPackage source references a known benign dynamic code generation pattern.
dash_antd_components/async-chart.jsView on unpkg · L1A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dash_antd_components/async-socket-io.js#virtual:string-array:round1View on unpkgA newly added or changed runtime dependency can resolve to an independently confirmed malicious package version.
package.jsonView on unpkgA newly added or changed runtime dependency can resolve to an independently confirmed malicious package version.
package.jsonView on unpkgThe manifest declares lodash 4.18.1 as a runtime dependency; dependency intelligence flagged this exact version as malicious.
package.jsonView on unpkg · L107Findings
Affected versions and remediation
This report applies to dash-ant-design@0.1.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing dash-ant-design@0.1.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.