
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@chart-sg/node-red-ros2-manager
Advanced tools
Shared ROS2 context manager for Node-RED plugins. Eliminates conflicts and enables multi-plugin compatibility.
A Node-RED module providing shared ROS2 context management and global configuration for Node-RED ROS2 plugins. This package enables multiple ROS2 plugins to coexist harmoniously in the same Node-RED process without conflicts.
⚠️ IMPORTANT: Cannot be installed via Node-RED Palette Manager
These packages require terminal installation with ROS2/RMF environment sourced. The Palette Manager installation will fail because rclnodejs needs access to ROS2 libraries during installation.
Important: This package requires rclnodejs to be pre-installed with proper ROS2 environment.
# Source your ROS2 environment
source /opt/ros/jazzy/setup.bash # (or your ROS2 distro)
# For RMF users, also source RMF workspace
source ~/rmf_ws/install/setup.bash
# Install rclnodejs in Node-RED directory
cd ~/.node-red
npm install rclnodejs
After setup, install the packages (this manager is installed automatically as dependency):
# Install from npm registry
cd ~/.node-red
npm install @chart-sg/node-red-ros2
# or
npm install @chart-sg/node-red-rmf
Critical Problem Solved: Direct rclnodejs usage in Node-RED's dynamic environment causes fundamental conflicts:
// Multiple plugins = Multiple contexts = Crashes
[node-red-ros2] → rclnodejs.init() → Context A
[node-red-rmf] → rclnodejs.init() → Context B → CRASH
[other-plugin] → rclnodejs.init() → Context C
// Single shared context + global config = Stable operation
[node-red-ros2] ↘
[node-red-rmf] → [ROS2 Manager] → Single Context + Config → SUCCESS
[other-plugin] ↗
rclnodejs.init() calls crash the processThis package is a Node-RED module that provides:
After installation, users get a ros2-config configuration node that is accessed through:
┌─────────────────────────────────────────────────────────────────┐
│ @chart-sg/node-red-ros2-manager │
│ (Node-RED Module) │
│ │
│ ┌─────────────────────┐ ┌──────────────────────────────┐ │
│ │ ros2-config │ │ SharedManager │ │
│ │ (Node-RED Node) │ │ (JavaScript Library) │ │
│ │ │ │ │ │
│ │ • Domain ID │◄──►│ • Single ROS2 Context │ │
│ │ • Namespace │ │ • Multi-Node Coordination │ │
│ │ • Visual Status │ │ • Resource Management │ │
│ └─────────────────────┘ │ • Error Recovery │ │
│ └──────────────────────────────┘ │
└─────────────────────────────────────────────────────────────────┘
▲ ▲
│ │
┌───────────┴──────────┐ ┌─────────┴─────────┐
│ @chart-sg/node- │ │ @chart-sg/node- │
│ red-ros2 │ │ red-rmf │
│ │ │ │
│ • publisher │ │ • start-task │
│ • subscriber │ │ • goto-place │
│ • action-client │ │ • end-task │
│ • service-client │ │ • rmf-config │
└──────────────────────┘ └───────────────────┘
This package is a required dependency for Chart ROS2 Node-RED packages and provides the centralized ros2-config node:
@chart-sg/node-red-ros2:
"dependencies": {
"@chart-sg/node-red-ros2-manager": "^1.0.0" ← Automatically installed
}
@chart-sg/node-red-rmf:
"dependencies": {
"@chart-sg/node-red-ros2-manager": "^1.0.0" ← Automatically installed
}
Why Required:
### **Spinning Coordination**
```javascript
// 100Hz Multi-Node Spinning Loop
setInterval(() => {
for (const [nodeId, nodeInfo] of this.nodes) {
try {
rclnodejs.spinOnce(nodeInfo.node); // Process each node's callbacks
// Actions receive responses
// Subscriptions get messages
// Services handle requests
} catch (error) {
// Conservative backoff: 100ms → 1000ms
}
}
}, 10);
# 1. Source ROS2 environment
source /opt/ros/jazzy/setup.bash # (or your ROS2 distro)
# 2. Install in Node-RED directory
cd ~/.node-red
npm install rclnodejs
npm install @chart-sg/node-red-ros2-manager
This package is automatically installed as a dependency when you install other Chart ROS2 packages.
This package provides a ros2-config configuration node that appears in Node-RED's palette:
Configuration nodes are not visible in the palette. Access ros2-config through:
ros2-config:
├── Domain ID: 69
└── Namespace: "" (empty)
Results in:
├── topic "/cmd_vel" stays "/cmd_vel"
├── action "/navigate" stays "/navigate"
└── All operations on domain 69
ros2-config:
├── Domain ID: 1
└── Namespace: "" (empty)
Result: Complete isolation from production (domain 0)
1. Install @chart-sg/node-red-ros2 or @chart-sg/node-red-rmf via Palette Manager
2. Add any ROS2 node (publisher, subscriber, etc.) to your flow
3. Double-click the ROS2 node to edit it
4. In the "ROS2 Config" dropdown, click the pencil icon to create new ros2-config
5. Configure domain (e.g., 69) and optional namespace
6. Deploy and use!
// In your Node-RED plugin's .js file
module.exports = function(RED) {
function MyROS2Node(config) {
RED.nodes.createNode(this, config);
// Get ROS2 configuration from ros2-config node
this.ros2Config = RED.nodes.getNode(config.ros2_config);
if (!this.ros2Config) {
this.error("ros2-config is required");
return;
}
// Access domain and namespace
const domain = this.ros2Config.domain;
const namespace = this.ros2Config.namespace;
// Use SharedManager
this.initializeROS2();
}
MyROS2Node.prototype.initializeROS2 = async function() {
try {
const { getROS2Manager } = require('@chart-sg/node-red-ros2-manager');
const manager = getROS2Manager();
// Initialize with ros2-config settings (handled by ros2-config node)
await manager.initialize();
// Create node through manager
const result = await manager.createNode(`${this.type}_${this.id}`);
this.nodeId = result.nodeId;
this.node = result.node;
this.status({fill: "green", shape: "dot", text: "connected"});
} catch (error) {
this.error("ROS2 initialization failed: " + error.message);
this.status({fill: "red", shape: "ring", text: "error"});
}
};
MyROS2Node.prototype.close = function(done) {
if (this.nodeId) {
const { getROS2Manager } = require('@chart-sg/node-red-ros2-manager');
const manager = getROS2Manager();
manager.destroyNode(this.nodeId);
}
done();
};
RED.nodes.registerType("my-ros2-node", MyROS2Node);
};
const { getROS2Manager } = require('@chart-sg/node-red-ros2-manager');
// Get the shared manager instance
const manager = getROS2Manager();
// Configure domain and namespace (usually done by ros2-config node in Node-RED)
manager.configure({
domain: 69,
namespace: '/robot1'
});
// Initialize shared ROS2 context
await manager.initialize();
// Create nodes and use normally...
Note: In Node-RED environments, configuration is typically handled by the ros2-config node automatically.
## API Reference
### **Getting the Manager**
```javascript
const { getROS2Manager } = require('@chart-sg/node-red-ros2-manager');
const manager = getROS2Manager();
configure(config)Configure global ROS2 settings (usually called by ros2-config node).
manager.configure({
domain: 69, // ROS2 domain ID (0-232)
namespace: '/robot1' // Optional namespace prefix
});
initialize(options)Initialize the shared ROS2 context (idempotent - safe to call multiple times).
await manager.initialize({
owner: 'my-application' // Optional owner identifier
});
createNode(nodeName)Create a ROS2 node through the shared manager.
const result = await manager.createNode('my_unique_node_name');
// Returns: { nodeId: string, node: rclnodejs.Node }
destroyNode(nodeId)Properly destroy a node and clean up resources.
manager.destroyNode(nodeId);
shutdown()Shutdown the entire shared ROS2 context.
await manager.shutdown();
[@chart-sg/node-red-ros2]: Basic ROS2 nodes (publisher, subscriber, action-client, service-client)
[@chart-sg/node-red-rmf]: RMF fleet management nodes
User installs: This manager provides:
┌─────────────────┐ ┌──────────────────────────┐
│ node-red-ros2 │────►│ • ros2-config node │
└─────────────────┘ │ • SharedManager library │
OR │ • Conflict prevention │
┌─────────────────┐ │ • Resource management │
│ node-red-rmf │────►│ │
└─────────────────┘ └──────────────────────────┘
This means the one-time rclnodejs setup wasn't completed:
# 1. Source ROS2 environment
source /opt/ros/jazzy/setup.bash
# 2. For RMF users, also source RMF workspace
source ~/rmf_ws/install/setup.bash
# 3. Install rclnodejs in Node-RED directory
cd ~/.node-red
npm install rclnodejs
# 4. Retry package installation
This means Node-RED wasn't started with ROS2 environment sourced:
# Stop Node-RED, then restart with ROS2 environment
source /opt/ros/jazzy/setup.bash
source ~/rmf_ws/install/setup.bash # RMF users only
node-red
If you see warnings about different domains:
Verify your ros2-config settings:
ros2 topic list to verify topic visibilityWhile this manager handles basic ROS2 setup, individual packages may have additional requirements:
# For RMF functionality, check RMF-specific requirements
cd ~/.node-red/node_modules/@chart-sg/node-red-rmf
npm run check-rmf
# For other packages, check their documentation for package-specific scripts
Enable detailed logging:
ROS2_MANAGER_DEBUG=true node-red
ISC License - see LICENSE file for details.
This package is developed by CHART to enable robust, conflict-free ROS2 integration in Node-RED and Node.js environments.
Summary: @chart-sg/node-red-ros2-manager provides the ros2-config node for centralized ROS2 configuration and the SharedManager library for conflict-free multi-package operation. Essential for any Node-RED ROS2 deployment with multiple packages or complex flows.
FAQs
Shared ROS2 context manager for Node-RED plugins. Eliminates conflicts and enables multi-plugin compatibility.
We found that @chart-sg/node-red-ros2-manager demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.