
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
@cardog/corgi
Advanced tools
Fast, offline VIN decoding for Node.js, browsers, and Cloudflare Workers. Powered by the NHTSA VPIC database.
Need more than basic VIN decoding? Check out the Cardog API for comprehensive vehicle data including market values, safety recalls, ownership costs, and more.
npm install @cardog/corgi
import { createDecoder } from "@cardog/corgi";
const decoder = await createDecoder();
const result = await decoder.decode("KM8K2CAB4PU001140");
console.log(result.components.vehicle);
// { make: 'Hyundai', model: 'Kona', year: 2023, ... }
await decoder.close();
import { createDecoder } from "@cardog/corgi";
const decoder = await createDecoder();
const result = await decoder.decode("1HGCM82633A123456");
// Custom database path
const decoder = await createDecoder({
databasePath: "/path/to/vpic.lite.db",
});
import { createDecoder } from "@cardog/corgi/browser";
const decoder = await createDecoder({
databasePath: "https://corgi.cardog.io/vpic.lite.db.gz",
runtime: "browser",
});
import { createDecoder, initD1Adapter } from "@cardog/corgi";
initD1Adapter(env.D1_DATABASE);
const decoder = await createDecoder({
databasePath: "D1",
runtime: "cloudflare",
});
const decoder = await createDecoder({
databasePath: "./custom/path.db",
forceFresh: true,
defaultOptions: {
includePatternDetails: true,
includeRawData: false,
confidenceThreshold: 0.8,
includeDiagnostics: true,
},
});
// Per-decode options
const result = await decoder.decode("VIN12345678901234", {
modelYear: 2024,
includePatternDetails: true,
});
interface DecodeResult {
vin: string;
valid: boolean;
components: {
vehicle?: {
make: string;
model: string;
year: number;
series?: string;
bodyStyle?: string;
driveType?: string;
fuelType?: string;
doors?: string;
};
wmi?: {
manufacturer: string;
make: string;
country: string;
region: string;
};
plant?: {
country: string;
city?: string;
code: string;
};
engine?: {
model?: string;
cylinders?: string;
displacement?: string;
fuel?: string;
};
modelYear?: {
year: number;
source: string;
confidence: number;
};
checkDigit?: {
isValid: boolean;
expected?: string;
actual: string;
};
};
errors: DecodeError[];
metadata?: DiagnosticInfo;
patterns?: PatternMatch[];
}
import { ErrorCode } from "@cardog/corgi";
const result = await decoder.decode("INVALID_VIN");
if (!result.valid) {
result.errors.forEach((error) => {
switch (error.code) {
case ErrorCode.INVALID_CHECK_DIGIT:
case ErrorCode.INVALID_LENGTH:
case ErrorCode.WMI_NOT_FOUND:
console.log(error.message);
}
});
}
npx @cardog/corgi decode 1HGCM82633A123456
npx @cardog/corgi decode 1HGCM82633A123456 --patterns --format json
npx @cardog/corgi --help
A Vehicle Identification Number (VIN) is a 17-character identifier assigned to every vehicle manufactured for road use. The structure is defined by ISO 3779 and follows this format:
Position: 1-3 4-8 9 10 11 12-17
WMI VDS Check Year Plant VIS
│ │ │ │ │ │
│ │ │ │ │ └─ Sequential production number
│ │ │ │ └───────── Assembly plant code
│ │ │ └─────────────── Model year (A-Y, 1-9, excluding I,O,Q,U,Z,0)
│ │ └─────────────────────── Check digit (0-9, X)
│ └──────────────────────────────── Vehicle attributes (model, body, engine, etc.)
└─────────────────────────────────────── World Manufacturer Identifier
WMI (Positions 1-3): Identifies the manufacturer. First character indicates country/region, second indicates manufacturer, third indicates vehicle type or manufacturing division.
VDS (Positions 4-8): Vehicle Descriptor Section. Manufacturer-defined attributes including model, body style, engine type, and restraint system.
Check Digit (Position 9): Validates VIN integrity using a weighted algorithm. Required for all vehicles sold in North America.
Model Year (Position 10): Encodes the model year. Uses letters A-Y (excluding I, O, Q, U, Z) and digits 1-9 in a 30-year cycle.
Plant Code (Position 11): Identifies the assembly plant. Manufacturer-specific encoding.
VIS (Positions 12-17): Vehicle Identifier Section. Sequential production number unique within the model year and plant.
The check digit (position 9) is calculated by:
[8,7,6,5,4,3,2,10,0,9,8,7,6,5,4,3,2]Per 49 CFR 565.15, model year codes cycle every 30 years:
| Code | Years |
|---|---|
| A | 1980, 2010 |
| B | 1981, 2011 |
| ... | ... |
| X | 1999, 2029 |
| Y | 2000, 2030 |
| 1 | 2001, 2031 |
| ... | ... |
| 9 | 2009, 2039 |
Characters I, O, Q are excluded from all VIN positions. U, Z, and 0 are additionally excluded from position 10.
Corgi uses an optimized subset of the NHTSA vPIC (Vehicle Product Information Catalog) database. The database is compressed and bundled with the package for offline operation.
Specifications:
Cardog maintains a public CDN with the latest VPIC database builds:
Base URL: https://corgi.cardog.io
| File | Description |
|---|---|
vpic.lite.db.gz | Database (gzip) |
vpic.lite.db.bz2 | Database (bzip2) |
vpic.lite.db.xz | Database (xz) |
vpic.lite.db.zst | Database (zstd) |
vpic.lite.json | Metadata (version, checksums, record counts) |
vpic.lite.sha256 | SHA256 checksums |
Dated archives are also available: vpic_lite_YYYYMMDD.db.gz
~/.corgi-cache/vpic.lite.dbimport { getDatabasePath } from "@cardog/corgi";
const dbPath = await getDatabasePath();
const decoder = await createDecoder({ forceFresh: true }); // Force refresh
// Core
import { createDecoder, quickDecode, getDatabasePath } from "@cardog/corgi";
// Types
import type { DecodeResult, DecodeOptions, DecoderConfig } from "@cardog/corgi";
// Enums
import { ErrorCode, ErrorCategory, BodyStyle } from "@cardog/corgi";
// Adapters
import { initD1Adapter } from "@cardog/corgi/d1-adapter";
import { createDecoder } from "@cardog/corgi/browser";
Corgi provides fast, offline VIN decoding - but if you need comprehensive vehicle intelligence, the Cardog API offers much more:
# Decode a VIN with full vehicle data
curl "https://api.cardog.io/v1/vin/1HGCM82633A123456" \
-H "x-api-key: your-api-key"
Get started at docs.cardog.app
ISC License - see LICENSE for details.
FAQs
Fast, offline VIN decoding for Node.js, browsers, and Cloudflare Workers. Powered by the NHTSA VPIC database.
The npm package @cardog/corgi receives a total of 1,486 weekly downloads. As such, @cardog/corgi popularity was classified as popular.
We found that @cardog/corgi demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.