Sourcemap Explorer
Stack · npm package

echarts

Apache ECharts is a powerful, interactive charting and data visualization library for browser

latest 6.1.0· Apache-2.0· 117 versions publishedView on npm

About

Apache ECharts is a powerful, interactive charting and data visualization library for browser

echartsdata-visualizationchartscharting-libraryvisualizationapachedata-vizcanvassvg

What detecting echarts tells you about a site

echarts (Apache ECharts) is a heavyweight, canvas-first charting engine with a vast feature set: large datasets, geographic maps, candlesticks, dense interactive dashboards. Spotting it signals a data-serious application where visualisation is a core feature, not decoration, and frequently points to enterprise, fintech, monitoring or analytics products. It is also extremely common on Chinese-origin and large-scale platforms given its origins at Baidu and adoption in that ecosystem, so its presence can hint at the project's lineage as much as its capabilities.

Why the exact echarts version matters

ECharts 5 was a major release that reworked the API surface, introduced tree-shakeable modular imports and changed defaults versus the version 4 line. The exact version therefore tells you whether the build can selectively import components (a big bundle-size difference) or pulls the full monolith, and which generation of chart types and options the configuration was written against.

echarts in a real-world stack

When you find echarts in a bundle, it rarely travels alone. Sometimes echarts-for-react on React projects; otherwise used framework-agnostically.

Quick facts

Latest version6.1.0
LicenseApache-2.0
Installnpm install echarts
Direct dependencies2

What echarts pulls in

echarts declares 2 direct dependencies — each one also rides into any bundle that ships echarts, so they are detection targets too. Reading them is a quick way to understand the package's real footprint .

tslibzrender

How Sourcemap Explorer detects echarts

echarts ships as v6.1.0, published 2026-05-19 and carries 2 direct dependencies, 117 versions on the registry. Those exact numbers are the footprint Sourcemap Explorer matches when echarts rides inside a deployed bundle — here is how the detection works.

We catch echarts from two complementary signals: bundled source paths and the embedded package.json. Modern bundlers (webpack, Vite, esbuild, Rollup, Turbopack) preserve the original node_modules/echarts/ paths inside the JavaScript sourcemap's sources[] array — that's the canonical signal. When the matching package.json is also captured in sourcesContent[], we read the exact version field — patch number included. No regex guessing, no version inference.

  1. 1

    Confirm the site exposes sourcemaps

    In DevTools Network, check the response headers of any application script for `SourceMap` or `X-SourceMap`. Failing that, fetch the script's last 4 KB and look for a `//# sourceMappingURL=` comment — that map is where the `echarts` paths live.

  2. 2

    Find the package in the bundle

    Open DevTools → Network → reload. Click any application script and look at its sourcemap. Inside, search `sources[]` for entries matching `node_modules/echarts/` — every match confirms the package is bundled. The matching `sourcesContent[i]` for `node_modules/echarts/package.json` gives you the exact installed version.

  3. 3

    Read the version directly from package.json

    Run `jq -r '. as $m | $m.sources | to_entries[] | select(.value | endswith("node_modules/echarts/package.json")) | $m.sourcesContent[.key] | fromjson | .version' bundle.js.map`. Sourcemap Explorer automates the same query in the popup.

Major releases of echarts

When each major version first landed. Major bumps are where breaking changes live, so this timeline is the fastest way to date the echarts version a site actually ships against the ecosystem.

Major
First release
Date
v6
6.0.0
2025-07-30
v5
5.0.0
2020-12-02
v4
4.0.0
2018-01-16
v3
3.0.0
2016-01-12
v2
2.2.8
2015-11-07

Recent security advisories for echarts

The 1 most recent advisories affecting some versions of echarts, aggregated from OSV.dev (GitHub Advisory + CVE data). A listing here doesn't mean the version a given site ships is affected — each advisory applies to a specific version range. Sourcemap Explorer reads the exact bundled version so you can check it against these ranges.

  1. MODERATECVE-2026-45249· 2026-05-26

    Apache ECharts has a cross-site scripting (XSS) vulnerability

Recent versions

Version
Released
6.1.0
2026-05-19
6.0.0
2025-07-30
5.6.0
2024-12-28
5.5.1
2024-06-27
5.5.0
2024-02-18
5.4.3
2023-07-18
5.4.2
2023-03-23
5.4.1
2022-12-09

echarts README

Live mirror of the GitHub README, for reference. Updated whenever the repo's default branch changes.

Apache ECharts

logo

Apache ECharts is a free, powerful charting and visualization library offering easy ways to add intuitive, interactive, and highly customizable charts to your commercial products. It is written in pure JavaScript and based on zrender, which is a whole new lightweight canvas library.

中文官网 | ENGLISH HOMEPAGE

License Latest npm release NPM downloads Contributors

Build Status

Get Apache ECharts

You may choose one of the following methods:

Docs

Get Help

Build

Build echarts source code:

Execute the instructions in the root directory of the echarts: (Node.js is required)

# Install the dependencies from NPM:
npm install

# Rebuild source code immediately in watch mode when changing the source code.
# It opens the `./test` directory, and you may open `-cases.html` to get the list
# of all test cases.
# If you wish to create a test case, run `npm run mktest:help` to learn more.
npm run dev

# Check the correctness of TypeScript code.
npm run checktype

# If intending to build and get all types of the "production" files:
npm run release

Then the "production" files are generated in the dist directory.

Contribution

Please refer to the contributing document if you wish to debug locally or make pull requests.

Resources

Awesome ECharts

https://github.com/ecomfe/awesome-echarts

Extensions

License

ECharts is available under the Apache License V2.

Code of Conduct

Please refer to Apache Code of Conduct.

Paper

Deqing Li, Honghui Mei, Yi Shen, Shuang Su, Wenli Zhang, Junting Wang, Ming Zu, Wei Chen. ECharts: A Declarative Framework for Rapid Construction of Web-based Visualization. Visual Informatics, 2018.

FAQ

What is echarts used for?

Apache ECharts is a powerful, interactive charting and data visualization library for browser

How can I tell if a website is using echarts?

Open the page in Chrome with the Sourcemap Explorer extension installed and read the Stack tab. We catch `echarts` from two complementary signals: `node_modules/echarts/` paths inside the JavaScript sourcemap, and the embedded `package.json` we read for exact-version detection. Without the extension you can do the same lookup manually in DevTools — the steps are listed in the "How Sourcemap Explorer detects" section above.

How do I find out which version of echarts a website is running?

Read it straight from the site's JavaScript sourcemap. When a build ships source maps, the bundled `echarts/package.json` carries the exact `version` string — Sourcemap Explorer extracts it in one click on the Stack tab, and you can do it by hand in DevTools by opening the `.map` file and searching for `node_modules/echarts/package.json`. That is far more reliable than inferring the version from an asset-hash or a `?ver=` query string, which is all surface-level detectors have to go on. The current npm release is 6.1.0, but real deployments frequently run an older pinned version — which is exactly why reading the bundled number matters.

What is the latest version of echarts?

6.1.0, as published on the npm registry. The "Recent versions" table on this page lists the most recent 8 releases with their release dates. Sourcemap Explorer reports the version actually bundled into a site, which can lag the latest release by months on real-world deployments.

Is echarts actively maintained?

Very actively maintained — the last release shipped within the past three months. The last published release was 2026-05-19. Source code: https://github.com/apache/echarts.

Does echarts have known security vulnerabilities?

1 recent advisory affecting some versions of echarts is listed in the "Recent security advisories" section above, aggregated from OSV.dev (GitHub Advisory + CVE data). Whether a particular site is exposed depends entirely on the exact version it ships — each advisory applies to a specific version range, not to the package as a whole. That is why the precise bundled version matters: Sourcemap Explorer reads the version a site actually runs, so you can check it against the affected ranges instead of assuming the latest release is what's deployed.

Where can I read more?

Project homepage: https://echarts.apache.org. Source code: https://github.com/apache/echarts. Published on npm: https://www.npmjs.com/package/echarts. Licensed as Apache-2.0.

Detected by Sourcemap Explorer

When a bundle ships sourcemaps, we read the embedded package.json for echarts and report the precise version (the registry's latest is v6.1.0, published 2026-05-19; the bundled copy is often older). Without sourcemaps, an import / require in the page's scripts is enough to flag it.

Install free on Chrome