Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
@cymen/node-postal
Advanced tools
These are the NodeJS bindings to libpostal, a fast, multilingual NLP library for parsing/normalizing physical addresses. libpostal is written in C because virtually every other language can bind to C.
@cymen/node-postal (npm @cymen/node-postal) is a hopefully temporary fork of openvenues/node-postal (npm node-postal). The fork was created in order to get the pending PRs merged for Node.js v12 compatibility.
var postal = require('node-postal');
// Expansion API
postal.expand.expand_address('V XX Settembre, 20');
// Parser API
postal.parser.parse_address('Barboncino 781 Franklin Ave, Crown Heights, Brooklyn, NY 11238');
Before using the Node bindings, you must install the libpostal C library. Make sure you have the following prerequisites:
On Ubuntu/Debian
sudo apt-get install curl autoconf automake libtool pkg-config
On CentOS/RHEL
sudo yum install curl autoconf automake libtool pkgconfig
On Mac OSX
brew install curl autoconf automake libtool pkg-config
Installing libpostal
git clone https://github.com/openvenues/libpostal
cd libpostal
./bootstrap.sh
./configure --datadir=[...some dir with a few GB of space...]
make
sudo make install
# On Linux it's probably a good idea to run
sudo ldconfig
Install node-gyp
Then install node-gyp system-wide:
sudo npm install -g node-gyp
Installing node-gyp on Linux (Ubuntu)
First make sure you have:
sudo apt-get install build-essential
on Ubuntu)Installing the Node bindings
npm install @cymen/node-postal
node-postal is tested on most major versions of Node (0.10+) in continuous integration. The C++ bindings are written using Nan, which abstracts the API changes across various versions of V8, so the latest versions of Node will likely work.
If you're having trouble compiling, post a Github issue with your OS and Node versions along with the output of npm install / node-gyp rebuild.
To run the unit tests:
npm test
Installing libpostal:
node-postal is a thin wrapper around libpostal, which is written in C. Installing node-postal with npm will not install libpostal as a dependency. The install steps described above will install it in standard locations for your OS. For OS X and Linux, that's /usr/local/include
and /usr/local/lib
. node-postal will look in these locations for the C libraries. If you have problems installing node-postal, check there for recently installed libpostal libraries.
Downloading Large Files
The make
process downloads ~750MB of data, ~2GB unzipped (note: these are production-quality machine learning models trained on over a billion addresses, that's how much disk/memory it takes). Make sure the --datadir argument to configure
, which requires an absolute path, has enough room to accommodate the models. If you get errors after downloading, e.g.:
make[3]: *** [all-local] Error 1
make[2]: *** [all-recursive] Error 1
make[1]: *** [all-recursive] Error 1
make: *** [all] Error 2
there may be problems with subsequent install steps. Occasionally something will go wrong and it will give up downloading. Once downloading is complete, the make script will unpack the langauge_classifier.tar.gz.X files. If you see these files, your download may have stopped. Try running the make script again.
Lucas Hrabovsky (https://github.com/imlucas) for information and examples of repos using Nan, node-gyp, etc.
FAQs
International address parsing/normalization at C speed
The npm package @cymen/node-postal receives a total of 7 weekly downloads. As such, @cymen/node-postal popularity was classified as not popular.
We found that @cymen/node-postal demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.