
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@foxglove/rosmsg
Advanced tools
ROS1 and ROS2 message definition parser
The Robot Operating System (ROS) defines a simplified message description language for describing data types. This library parses those message definitions and can round trip them back into a canonical string format suitable for checksum generation. The parsed definitions are useful for serialization or deserialization when paired with other libraries.
This library supports both ROS1 and ROS 2 message definitions.
import { parse, stringify } from "@foxglove/rosmsg";
const definitionStr = `# geometry_msgs/Pose
geometry_msgs/Point position
geometry_msgs/Quaternion orientation
===
MSG: geometry_msgs/Point
float64 x
float64 y
float64 z
===
MSG: geometry_msgs/Quaternion
float64 x
float64 y
float64 z
float64 w`;
const messageDefinition = parse(definitionStr);
// print the parsed message definition structure
console.log(JSON.stringify(messageDefinition, null, 2));
Prints:
[
{
"definitions": [
{
"type": "geometry_msgs/Point",
"isArray": false,
"name": "position",
"isComplex": true
},
{
"type": "geometry_msgs/Quaternion",
"isArray": false,
"name": "orientation",
"isComplex": true
}
]
},
{
"name": "geometry_msgs/Point",
"definitions": [
{
"type": "float64",
"isArray": false,
"name": "x",
"isComplex": false
},
{
"type": "float64",
"isArray": false,
"name": "y",
"isComplex": false
},
{
"type": "float64",
"isArray": false,
"name": "z",
"isComplex": false
}
]
},
{
"name": "geometry_msgs/Quaternion",
"definitions": [
{
"type": "float64",
"isArray": false,
"name": "x",
"isComplex": false
},
{
"type": "float64",
"isArray": false,
"name": "y",
"isComplex": false
},
{
"type": "float64",
"isArray": false,
"name": "z",
"isComplex": false
},
{
"type": "float64",
"isArray": false,
"name": "w",
"isComplex": false
}
]
}
]
import { parse, stringify } from "@foxglove/rosmsg";
const definitionStr = `# geometry_msgs/msg/Pose
geometry_msgs/msg/Point position
geometry_msgs/msg/Quaternion orientation
===
MSG: geometry_msgs/msg/Point
float64 x
float64 y
float64 z
===
MSG: geometry_msgs/msg/Quaternion
float64 x
float64 y
float64 z
float64 w`;
const messageDefinition = parse(definitionStr, {ros2: true});
// stringify(messageDefinition) will return a canonical string, similar to
// _definitionStr_
// print the parsed message definition structure
console.log(JSON.stringify(messageDefinition, null, 2));
Prints:
[
{
"definitions": [
{
"type": "geometry_msgs/msg/Point",
"isArray": false,
"name": "position",
"isComplex": true
},
{
"type": "geometry_msgs/msg/Quaternion",
"isArray": false,
"name": "orientation",
"isComplex": true
}
]
},
{
"name": "geometry_msgs/msg/Point",
"definitions": [
{
"type": "float64",
"isArray": false,
"name": "x",
"isComplex": false
},
{
"type": "float64",
"isArray": false,
"name": "y",
"isComplex": false
},
{
"type": "float64",
"isArray": false,
"name": "z",
"isComplex": false
}
]
},
{
"name": "geometry_msgs/msg/Quaternion",
"definitions": [
{
"type": "float64",
"isArray": false,
"name": "x",
"isComplex": false
},
{
"type": "float64",
"isArray": false,
"name": "y",
"isComplex": false
},
{
"type": "float64",
"isArray": false,
"name": "z",
"isComplex": false
},
{
"type": "float64",
"isArray": false,
"name": "w",
"isComplex": false
}
]
}
]
See (@foxglove/ros2idl-parser)[https://github.com/foxglove/omgidl/packages/ros2idl-parser] for our implementation of ros2idl schema support.
@foxglove/rosmsg is licensed under the MIT License.
yarn version --[major|minor|patch] to bump versiongit push && git push --tags to push new tagJoin our Discord community to ask questions, share feedback, and stay up to date on what our team is working on.
FAQs
Parser for ROS and ROS 2 .msg definitions
We found that @foxglove/rosmsg demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.