
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@wecity/img-mark
Advanced tools
npm i @wecity/img-mark -S
@wecity/img-mark是一个二次封装的图片标注工具
初始化画布,返回Promise
<div id='cvs'></div>
import { imgMark } from '@wecity/img-mark'
const gmap = await imgMark.initMap({ id: 'cvs', img: pic, options: { zoom, mode: 'BAN' } })
| 字段名 | 类型 | 描述 |
|---|---|---|
| id | object | map container |
| img | png/gif等 | 标注图片 |
| options | object | 配置项 |
初始化标注图片,返回Promise
<div id='cvs'></div>
import { imgMark } from '@wecity/img-mark'
const gmap = await imgMark.initMap({ id: 'cvs', img: pic, options: { zoom, mode: 'BAN' } })
const imgLayer = await imgMark.initImg({ img: pic, map: gMap })
| 字段名 | 类型 | 描述 |
|---|---|---|
| map | gMap | gMap |
| img | png/gif等 | 标注图片 |
| zIndex | int | 层级 |
初始化Feature,返回Promise
<div id='cvs'></div>
import { imgMark } from '@wecity/img-mark'
const gmap = await imgMark.initMap({ id: 'cvs', img: pic, options: { zoom, mode: 'BAN' } })
const imgLayer = await imgMark.initImg({ img: pic, map: gMap })
const featureLayer = await imgMark.initFeature({ map: gMap, img: pic, registerEvt: true })
| 字段名 | 类型 | 描述 |
|---|---|---|
| map | gMap | gMap |
| img | png/gif等 | 标注图片 |
| zIndex | int | 层级 |
| registerEvt | boolean | 默认注册一些通用的事件 |
map.events.on('featureSelected', feature => {
map.setActiveFeature(feature);
})
map.events.on('featureUnselected', () => {
map.setActiveFeature(null);
})
map.events.on('featureUpdated', (feature, shape) => {
feature.updateShape(shape);
})
map.events.on('drawDone', async (type, data) => {
const drawingStyle = map.drawingStyle
const uuid = utils.getUuid(type)
if (FEATURE_MODULE.includes(type)) {
const module = utils.bigCamel(type)
const instance = new AILabel.Feature[module](
uuid, // id
getModeData(type, data), // shape
{name: uuid}, // props
drawingStyle // style
)
feature.addFeature(instance)
}
})
绑定自定义数据大屏props到feature
| 字段名 | 类型 | 描述 |
|---|---|---|
| any | any | 自定义数据 |
// 设置
const instance = new AILabel.Feature[module](
uuid, // id
shape, // shape
{ name: uuid, extra: this.extraData }, // props
drawingStyle // style
)
feature.addFeature(instance)
// 获取
feature = {
props: {
extra: ''
}
}
| 方法名 | 参数 | 描述 |
|---|---|---|
| bigCamel | str => string | 字符串转大驼峰,如: Camel |
| getUuid | str => string | uuid |
| getImgInfo | image | 获取图片信息:宽高等, 返回promise |
| hex2rgb | color(16进制), 透明的 | 16进制转rgba |
import { utils } from '@wecity/img-mark'
utils.bigCamel('CAMEL') // Camel
utils.bigCamel('camel') // Camel
ailabel方法import AILabel from 'ailabel'
const imgMark = {
...AILabel
}
export default imgMark
FAQs
We found that @wecity/img-mark demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 18 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.