
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
@wikimedia/kartotherian-geoshapes
Advanced tools
Kartotherian service to generate geometric shapes from PostgreSQL data
Kartotherian service to generate geometric shapes from PostgreSQL data
See https://github.com/kartotherian/kartotherian
To configure, add geoshapes section to the kartotherian configuration with the following parameters:
geoshapes:
host: localhost
database: gis
table: planet_osm_polygon
user: ...
password: ...
maxidcount: (int, optional, default=500) - Maximum number of IDs to allow per request
allowUserQueries: (bool, optional, default=false) - If true, allow sql parameter + args to specify which SQL to use
wikidataQueryService: (string, optional, default=https://query.wikidata.org/bigdata/namespace/wdq/sparql) - Lets user get a list of WikidataIDs from an external Wikidata Query Service. if false, disables.
Without this config block, the service will skip its loading
Make sure to create a Postgres index, e.g.:
CREATE INDEX planet_osm_polygon_wikidata
ON planet_osm_polygon ((tags -> 'wikidata'))
WHERE tags ? 'wikidata';
Service will return topojson to the queries such as /geoshape?ids=Q1384,Q1166 (get New York and Michigan state shapes).
Save result as a file and upload to http://www.mapshaper.org/ to visualize.
Additionally, the service allows query=... parameter to get the Wikidata IDs from the http://query.wikidata.org service. It calls the service to execute
a query, extracts IDs, and matches them with the shapes in the OSM database. All other values are returned as topojson object properties.
Optional truthy parameter getgeojson=1 will force the result to be returned as geojson rather than topojson.
FAQs
Kartotherian service to generate geometric shapes from PostgreSQL data
We found that @wikimedia/kartotherian-geoshapes demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 25 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.