Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
@open-formulieren/leaflet-tools
Advanced tools
Shared utilities for Leaflet maps and Dutch (NL) geo standards
Leaflet tools sets up some commonly shared/copy-pasted snippets for working with Dutch (goverment) geo standards, such as the "Rijksdriehoek" (RD) coordinate system.
The library ships constants/utilities that can be used both in imperative, vanilla JS or with UI libraries like React.
import * as L from 'leaflet';
import {CRS_RD, TILE_LAYER_RD} from '@open-formulieren/leaflet-tools';
const map = L.map('my-map', {
continuousWorld: true,
crs: CRS_RD, // use Rijksdriehoek coordinate system
attributionControl: true,
center: [52.1326332, 5.291266], // must be provided as EPSG:4326 coordinates, is transformed via `crs` option
zoom: 3, // value between 0-13
});
const {url, ...options} = TILE_LAYER_RD;
const tiles = L.tileLayer(url, options);
map.addLayer(tiles);
import {MapContainer, TileLayer} from 'react-leaflet';
import {CRS_RD, TILE_LAYER_RD} from '@open-formulieren/leaflet-tools';
const MyMap = () => (
<MapContainer
continuousWorld
crs={CRS_RD}
attributionControl
center={[52.1326332, 5.291266]}
zoom={3}
>
<TileLayer {...TILE_LAYER_RD} />
</MapContainer>
);
While the code itself is not particularly exciting, there are a lot of magic numbers and configuration that require some context to properly judge them and recording that context is arguably the biggest benefit of a standalone library/repository.
The Geoforum thread is quite informative, as it points to the PROJ4 projection that is defined in this library, which itself is taken from an examples repository by @arbakker. It points out a number of issues:
In search of a definitive source on what and how things should be done, we also came across other implementations which use different PROJ4 transformation strings. The particular transformation string in this codebase was not found on epsg.io, but that doesn't really mean anything, as this is not an official/authorative source (!). epsg.org is the actual authorative database, and the Dutch geo organizations submit official dataset there.
Geonovum/kadaster also supports nlmaps.nl, which doesn't appear to apply the RD CRS but instead uses either the global or European coordinate systems. Some transformation strings were found in commented out code.
The data.amsterdam.nl map view was inspected, which yielded the same transformation string as used in this codebase. It is plausible they also took it from @arbakker's example repository.
With regard to a bunch of magic numbers, the document "Nederlandse richtlijn tiling versie 1.1" was quite informative and provided context, such as describing the resolution (in pixels per meter) for each zoom level, where the zoom levels map 1-to-1 to the zoom levels used in Leaflet (leaflet supports 0-20, but the document provides in zoom levels 1-13).
From this short summary, you can conclude that this is an extremely big and complicated topic and the disclaimer then also follows that if (high) accuracy is crucial, you definitely should not be using this library.
References
FAQs
Shared utilities for Leaflet maps and Dutch (NL) geo standards
The npm package @open-formulieren/leaflet-tools receives a total of 996 weekly downloads. As such, @open-formulieren/leaflet-tools popularity was classified as not popular.
We found that @open-formulieren/leaflet-tools demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.