Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/tidwall/rtree
This package provides an in-memory R-Tree implementation for Go. It's designed for Tile38 and is optimized for fast rect inserts and replacements.
To start using rtree, install Go and run go get
:
$ go get -u github.com/tidwall/rtree
// create a 2D RTree
var tr rtree.RTree
// insert a point
tr.Insert([2]float64{-112.0078, 33.4373}, [2]float64{-112.0078, 33.4373}, "PHX")
// insert a rect
tr.Insert([2]float64{10, 10}, [2]float64{20, 20}, "rect")
// search
tr.Search([2]float64{-112.1, 33.4}, [2]float64{-112.0, 33.5},
func(min, max [2]float64, data interface{}) bool {
println(data.(string)) // prints "PHX"
},
)
// delete
tr.Delete([2]float64{-112.0078, 33.4373}, [2]float64{-112.0078, 33.4373}, "PHX")
// create a 2D RTree
var tr rtree.RTreeG[string]
// insert a point
tr.Insert([2]float64{-112.0078, 33.4373}, [2]float64{-112.0078, 33.4373}, "PHX")
// insert a rect
tr.Insert([2]float64{10, 10}, [2]float64{20, 20}, "rect")
// search
tr.Search([2]float64{-112.1, 33.4}, [2]float64{-112.0, 33.5},
func(min, max [2]float64, data string) bool {
println(data) // prints "PHX"
},
)
// delete
tr.Delete([2]float64{-112.0078, 33.4373}, [2]float64{-112.0078, 33.4373}, "PHX")
// create a 2D RTree
var tr rtree.RTreeGN[float32, string]
// insert a point
tr.Insert([2]float32{-112.0078, 33.4373}, [2]float32{-112.0078, 33.4373}, "PHX")
// insert a rect
tr.Insert([2]float32{10, 10}, [2]float32{20, 20}, "rect")
// search
tr.Search([2]float32{-112.1, 33.4}, [2]float32{-112.0, 33.5},
func(min, max [2]float32, data string) bool {
println(data) // prints "PHX"
},
)
// delete
tr.Delete([2]float32{-112.0078, 33.4373}, [2]float32{-112.0078, 33.4373}, "PHX")
This implementation is a variant of the original paper:
R-TREES. A DYNAMIC INDEX STRUCTURE FOR SPATIAL SEARCHING
Similar to the original algorithm. From the root to the leaf, the rects which will incur the least enlargment are chosen. Ties go to rects with the smallest area.
Added to this implementation: when a rect does not incur any enlargement at all, it's chosen immediately and without further checks on other rects in the same node. This make point insertion faster.
Same as the original algorithm. A target rect is deleted directly. When the number of children in a rect falls below it's minumum entries, it is removed from the tree and it's items are re-inserted.
Same as the original algorithm.
This is a custom algorithm. It attempts to minimize intensive operations such as pre-sorting the children and comparing overlaps & area sizes. The desire is to do simple single axis distance calculations each child only once, with a target 50/50 chance that the child might be moved in-memory.
When a rect has reached it's max number of entries it's largest axis is calculated and the rect is split into two smaller rects, named left
and right
.
Each child rects is then evaluated to determine which smaller rect it should be placed into.
Two values, min-dist
and max-dist
, are calcuated for each child.
min-dist
is the distance from the parent's minumum value of it's largest axis to the child's minumum value of the parent largest axis.max-dist
is the distance from the parent's maximum value of it's largest axis to the child's maximum value of the parent largest axis.When the min-dist
is less than max-dist
then the child is placed into the left
rect.
When the max-dist
is less than min-dist
then the child is placed into the right
rect.
When the min-dist
is equal to max-dist
then the child is placed into an equal
bucket until all of the children are evaluated.
Each equal
rect is then one-by-one placed in either left
or right
, whichever has less children.
Finally, sort all the rects in the parent node of the split rect by their minimum x value.
rtree source code is available under the MIT License.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.