
Security News
OpenClaw Skill Marketplace Emerges as Active Malware Vector
Security researchers report widespread abuse of OpenClaw skills to deliver info-stealing malware, exposing a new supply chain risk as agent ecosystems scale.
@mapbox/mapbox-gl-geocoder
Advanced tools
A geocoder control for mapbox-gl-js using the Mapbox Geocoding API. For a JavaScript geocoder without a graphical user interface see the Mapbox SDK for JS.
If you are supporting older browsers, you will need to use a polyfill. We recommend working with @babel/polyfill.
npm install --save @mapbox/mapbox-gl-geocoder
import MapboxGeocoder from '@mapbox/mapbox-gl-geocoder';
import '@mapbox/mapbox-gl-geocoder/dist/mapbox-gl-geocoder.css';
...
const geocoder = new MapboxGeocoder({
accessToken: mapboxgl.accessToken,
mapboxgl: mapboxgl
});
It is possible to use the plugin without it being placed as a control on a mapbox-gl map. Keep in mind that the Mapbox Terms of Service require that POI search results be shown on a Mapbox map. If you don't need POIs, you can exclude them from your search results with the options.types parameter when constructing a new Geocoder.
See API.md for complete reference.
See https://docs.mapbox.com/mapbox-gl-js/examples/#geocoder.
See CONTRIBUTING.md.
FAQs
A geocoder control for Mapbox GL JS
We found that @mapbox/mapbox-gl-geocoder demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 28 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Security researchers report widespread abuse of OpenClaw skills to deliver info-stealing malware, exposing a new supply chain risk as agent ecosystems scale.

Security News
Claude Opus 4.6 has uncovered more than 500 open source vulnerabilities, raising new considerations for disclosure, triage, and patching at scale.

Research
/Security News
Malicious dYdX client packages were published to npm and PyPI after a maintainer compromise, enabling wallet credential theft and remote code execution.