npm / PACKAGE INTELLIGENCE

plotly.js

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Behind the package

View on npm

Explore what the publisher declares for the latest npm release. These details are not a safety score; listed attestations have not been independently verified here.

The open source javascript graphing library that powers plotly

Latest release4.1.2

Declared licenseMIT

Listed maintainerschriddyp, bpostlethwaite, antrg, bronsolo, t4rk, roman-nb, camdecoster, alexcjohnson, aborrmann, emilykl-plotly, packages-team-plotly

Runtime dependencies42

Install-time scriptsNone declared

Integrity metadataRecorded by registry

Attestation metadataNot recorded

Registry deprecationNot marked deprecated

Direct dependencies of 4.1.2

culori^4.0.2
d3-geo^1.12.1
d3-time^1.1.0
gl-mat4^1.2.0
gl-text^1.4.0
d3-force^1.2.1
@types/d3^3.5.53
d3-format^1.4.5
has-hover^1.0.1
is-mobile^5.0.0
@plotly/d33.8.2
@turf/area^7.4.0
@turf/meta^7.4.0
polybooljs^1.2.2
regl-splom^1.0.14
maplibre-gl6.11.2
regl-line2d^3.1.4
@plotly/regl^2.1.2
d3-hierarchy^1.1.9
regl-error2d^2.0.12
svg-path-sdf^2.0.0
webgl-context^2.2.0
@turf/centroid^7.4.0
d3-interpolate^3.0.1
d3-time-format^2.3.0
fast-isnumeric^1.1.4
parse-svg-path^0.2.0
regl-scatter2d^3.4.0
topojson-client^3.1.0
world-calendars^1.0.4
point-in-polygon^1.1.0
probe-image-size^7.4.0
@plotly/d3-sankey0.12.3
d3-geo-projection^2.9.0
base64-arraybuffer^1.0.2
country-iso-search^0.1.2
has-passive-events^1.0.0
mouse-event-offset^3.0.2
native-promise-only^0.8.1
@plotly/point-cluster^3.1.9
@plotly/d3-sankey-circular0.33.1
strongly-connected-components^1.0.1

Fetched 28/10/2026, 10:55:31 UTC · Original registry metadata

Release history

Explore up to 40 recent releases. Pick a version for an OSV check; registry metadata alone does not tell you whether a release has known vulnerabilities.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

critical9.8

GHSA-wjc4-73q6-gv3mFix available

plotly.js prototype pollution vulnerability

03 Jan 2024

plotly.js npm

Affected range	Recorded fix
Earlier releases before 2.25.2Semantic versions	2.25.2

Version evidence: OSV · GHSA-wjc4-73q6-gv3m

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "2.25.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}