
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@arcgis/codemod
Advanced tools
A codemod toolkit for updating and modernizing ArcGIS Maps SDK for JavaScript codebases.
A codemod toolkit for updating and modernizing ArcGIS Maps SDK for JavaScript codebases.
This package provides automated refactors to help migrate away from deprecated or legacy patterns. Starting with removing the __esri namespace in TypeScript projects and replacing it with explicit imports.
__esri namespace usage@arcgis/core imports.gitignore by defaultThe codemod replaces __esri types with explicit imports from @arcgis/core.
Note: Before running the codemod, update all
@arcgis/*packages in yourpackage.jsonto the most recent version.
Run it in the root of your project:
npx @arcgis/codemod run refactor-out-esri-namespace
By default, the codemod runs on all TypeScript files in the current directory and subdirectories, excluding files ignored by your .gitignore.
You can manually run it on a different directory by providing an argument:
npx @arcgis/codemod run refactor-out-esri-namespace target-directory
Before:
let geometry: __esri.Geometry;
let featureSet: __esri.FeatureSet;
After:
import type Geometry from "@arcgis/core/geometry/Geometry";
import type FeatureSet from "@arcgis/core/rest/support/FeatureSet";
let geometry: Geometry;
let featureSet: FeatureSet;
The codemod will emit warnings for cases it cannot safely rewrite, including:
__esri references inside JSDoc commentsThese will be reported in the console, manually review all changes before committing. If your project uses ESLint, Prettier, or other formatters/linters, run them after the codemod to ensure consistent formatting.
Note: This codemod modifies files in place and does not provide an interactive dry-run mode. We recommend running it in a project that is under version control (Git) so you can review changes using
git diffor your IDE’s diff tools. If your project is not under version control, create a backup before running the codemod.
COPYRIGHT Esri
This package is licensed under the terms described in the LICENSE.md file, located in the root of the package, and at https://js.arcgis.com/5.0/LICENSE.txt.
For third party notices, see https://js.arcgis.com/5.0/third-party-notices.txt.
FAQs
A codemod toolkit for updating and modernizing ArcGIS Maps SDK for JavaScript codebases.
We found that @arcgis/codemod demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.