registry / dash-ant-design / 0.1.0
dash-ant-design@0.1.0
A dash component library based on ant design
AI Security Review
scanned 28d ago · by lpm-firewall-aiSource inspection found no install lifecycle hook or runtime self-dependency. The flagged dynamic code and network behavior are consistent with chart map parsing and Prism file highlighting, with no concrete malicious behavior established.
Static reason
One or more suspicious static signals were detected.
Trigger
A consumer renders the relevant ECharts or Markdown component.
Impact
No package-controlled exfiltration or install-time mutation was established.
Mechanism
The bundle loads the chart component on demand, parses map data, and supports requesting a file URL for syntax highlighting.
AI rationale
Source inspection found no install lifecycle hook or runtime self-dependency. The flagged dynamic code and network behavior are consistent with chart map parsing and Prism file highlighting, with no concrete malicious behavior established.
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json lists build and publish scripts but no install lifecycle hook.
- The runtime dependencies are UI and charting libraries; the package does not depend on itself.
- The main bundle loads ECharts only when the ECharts component is used.
- ECharts uses dynamic code generation to parse supplied GeoJSON map data.
- The Markdown bundle’s XHR retrieves a URL for Prism file highlighting; no credential or environment data is sent.
Evidence against
Behavioral surface
CryptoEnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
6 flaggeddash_antd_components/async-g2.jsView file
1(self.webpackChunkdash_antd_components=self.webpackChunkdash_antd_components||[]).push([["async-g2"],{"./node_modules/.pnpm/@antv+coord@0.4.7/node_modules/@antv/coord/dist/coordina...
Low
Eval
Package source references a known benign dynamic code generation pattern.
dash_antd_components/async-g2.jsView on unpkg · L1dash_antd_components/async-echarts.jsView file
•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 4
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dash_antd_components/async-echarts.jsView on unpkgpackage.jsonView file
Findings
3 Critical1 High2 Medium6 Low
CriticalKnown Malicious Dependency Insertionpackage.json
CriticalKnown Malicious Dependency Insertionpackage.json
CriticalKnown Malicious Dependency Insertionpackage.json
HighSemantic Analysis Limiteddash_antd_components/async-echarts.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEvaldash_antd_components/async-g2.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to dash-ant-design@0.1.0.
See all versions of dash-ant-design for other recorded verdicts.
- Review the evidence and your use of dash-ant-design@0.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.