
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@graphhopper/graphhopper-js-api-client
Advanced tools
A Javascript Client for the GraphHopper Directions API
This project offers JavaScript clients for the GraphHopper Directions API.
Install the lib with npm:
npm install @graphhopper/graphhopper-js-api-client --save
Notice the @graphhopper organization since 15th September 2025.
You can either require the whole client enabling you to use every GraphHopper API, but you can also only require the pieces you need.
require('graphhopper-js-api-client');
window.onload = function() {
let defaultKey = "[Sign-up for free and get your own key: https://www.graphhopper.com/products/]";
let ghRouting = new GraphHopper.Routing({key: defaultKey}, {profile:"car", elevation: false});
ghRouting.doRequest({points:[[8.534317, 47.400905], [8.538265, 47.394108]]})
.then(json => {
// Add your own result handling here
console.log(json);
})
.catch(err => {
console.error(err.message);
});
};
In order to run the tests, you have to register for a key on GraphHopper.
Either set your key as environment variable using export GHKEY=YOUR_KEY or set your key in spec/helpers/config.js.
You can run all tests via npm test.
If you only want to run a single spec file, you can use the --spec option, e.g., npm test --spec spec/GraphHopperRoutingSpec.js.
You can either use our bundled version, including all APIs or you can use only the pieces you need.

You need the routing client.
There is also a different client developed from the community here.

You need the optimization client.

You need the isochrone client

You need the matrix client.

You need the geocoding client.

You need the map matching client and the togeojson.js
Set the version you like to publish in the package.json. Every version can only be published once and cannot be overwritten.
Tag the commit you like to publish for example like this:
git log # get the commit hash of the commit you want to tag
git tag <tag> <commit-hash>
git push origin --tag <tag>
GitHub will then build and publish the commit to NPM.
Code stands under Apache License 2.0
FAQs
A Javascript Client for the GraphHopper Directions API
We found that @graphhopper/graphhopper-js-api-client demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.