dash-ant-design@0.1.1
A dash component library based on ant design
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe manifest confirms the dependency and exact version flagged as malicious. This dependency insertion is sufficient to block publication; the dependency source was unavailable to establish its behavior in more detail.
Static reason
One or more suspicious static signals were detected.
Trigger
Dependency installation by a consumer of this package.
Impact
Installing the package may install and run malicious dependency code.
Mechanism
The manifest adds lodash 4.18.1; malicious behavior is attributed to that dependency version, whose source was not available for inspection.
Attack narrative
The package declares lodash 4.18.1 as a runtime dependency, and dependency intelligence flags that exact version as malicious. The dependency's source was unavailable, so its specific behavior and any endpoints could not be confirmed.
AI rationale
The manifest confirms the dependency and exact version flagged as malicious. This dependency insertion is sufficient to block publication; the dependency source was unavailable to establish its behavior in more detail.
Evidence
package.json
Decision evidence
public snapshotAI called this Malicious at 91.0% confidence as Malware with low false-positive risk.
Evidence for block
- The manifest declares lodash 4.18.1 as a runtime dependency; dependency intelligence flagged this exact version as malicious.
Evidence against
- The package describes itself as a Dash component library and has no install lifecycle hook in its scripts.
- The Socket.IO component creates a connection from component props, so its network activity is configurable application behavior.
Behavioral surface
CryptoEnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
5 flaggeddash_antd_components/async-chart.jsView file
1(self.webpackChunkdash_antd_components=self.webpackChunkdash_antd_components||[]).push([["async-chart"],{"./node_modules/.pnpm/@antv+coord@0.4.7/node_modules/@antv/coord/dist/coord...
Low
Eval
Package source references a known benign dynamic code generation pattern.
dash_antd_components/async-chart.jsView on unpkg · L1dash_antd_components/async-socket-io.js#virtual:string-array:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dash_antd_components/async-socket-io.js#virtual:string-array:round1View on unpkgFindings
2 Critical2 High2 Medium5 Low
CriticalKnown Malicious Dependency Insertionpackage.json
CriticalKnown Malicious Dependency Insertionpackage.json
HighSemantic Analysis Limiteddash_antd_components/async-socket-io.js#virtual:string-array:round1
HighSuspicious Dependency Evidencepackage.json
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEvaldash_antd_components/async-chart.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to dash-ant-design@0.1.1.
See all versions of dash-ant-design for other recorded verdicts.
- Avoid installing dash-ant-design@0.1.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.