
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@mkerkstra/jsts-cjs
Advanced tools
A CommonJS fork of JSTS: A JavaScript library of spatial predicates and functions for processing geometry
JSTS is an ECMAScript library of spatial predicates and functions for processing geometry conforming to the Simple Features Specification for SQL published by the Open Geospatial Consortium. JSTS is also a port of the well established Java library JTS.
The primary goal of the project is to provide web mapping applications with a complete library for processing and analyzing simple geometries but JSTS can also be used as a free standing geometry library.
JSTS was made using automatic translation of the original JTS Java source via AST to AST transformation preserving the JTS API, except for the I/O related classes which has been selectively and manually ported with support for WKT, GeoJSON and OpenLayers 3+.
A Google group is available for discussions.
A port of JTS Validation Suite provides additional tests.
Basic functionality together with OpenLayers is demonstrated here.
An ES5 (the most common JavaScript variant) compatible build for browsers is available here.
An ES6+ compatible build for browsers is available here.
Including the above build as a script will import a global object jsts exposing similar public API as org.locationtech.jts in the JTS API.
For Node.js 14+, install using npm install jsts after which you can import individual modules with fx. import GeoJSONReader from 'jsts/org/locationtech/jts/io/GeoJSONReader.js'. Note that since some time JSTS is only delivered as ES modules and you should be aware of https://nodejs.org/api/esm.html and specifically https://nodejs.org/api/esm.html#interoperability-with-commonjs.
I/O related classes in JTS had to be manually ported. From the original formats WKT and GeoJSON are supported. A direct reader/writer for OpenLayers 3+ geometries exist. See the API documentation for these specific classes.
As of version 1.4.0 it's possible to depend on the source modules directly using the NPM package. For most environments it will require a bundler like Rollup to work. topolis serves as an example project depending on JSTS in this way. The example page also exists in a version that loads JSTS as modules in supporting browsers .
createMultiPoint in GeometryFactory which only works with Point[] arguments.TopologyException thrown as an Error. This is expected if a calculation fails due to precision issues. To resolve this issue try reducing precision in the input and at the same time make sure the input is valid as defined by the OGC Simple Features specification. To reduce precision GeometryPrecisionReducer can be used..buffer, .intersects and more) unless using the bundled ES5 version that has these monkey patched in. The shortcut methods have been removed because they cause difficult circular dependencies. You can find the equivalent methods on the appropriate operation class.FAQs
A CommonJS fork of JSTS: A JavaScript library of spatial predicates and functions for processing geometry
We found that @mkerkstra/jsts-cjs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.