feat: add antv-block incident block list for 317 packages

[killagu]

Summary

Adds config["bug-versions"] entries for the antv-block supply-chain incident of 2026-05-19, in which 637 versions across 317 packages were published — each minor/patch-bumped above the package's last stable release, in two batches within ~30 minutes.

Every blocked version redirects to the last clean release:

• normally the package's dist-tag latest (npm kept that tag intact for all but one package);
• where latest itself was compromised — only uri-parse, whose latest pointed at the malicious 1.2.0 — the newest clean stable version is used instead (uri-parse → 1.0.0).

Stats

• 317 packages / 637 versions added
• diff: package.json only, +3182 lines, no deletions
• node --test passes

Excluded — needs manual review

• @antv/g6-lite — its only published version (0.1.0-beta.1) is itself the suspect one, so there is no clean version to redirect to. Left out of this PR; should be handled via package takedown instead.

Relation to #290

This supersedes #290, which covered 269 of the 318 source packages and omitted 49 — including uri-parse, whose naive "default to latest" target would have pointed straight back at the malicious version.

🤖 Generated with Claude Code

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

💤 Files selected but had no reviewable changes (1)

• package.json

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: ba1552fd-05df-4564-9b82-35f99d622de6

📥 Commits

Reviewing files that changed from the base of the PR and between a79e821 and 03d04ef.

📒 Files selected for processing (1)

• package.json

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

🎉 This PR is included in version 1.121.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀