
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
LasStreamReader
Advanced tools
Parse LIDAR files in LAS v1.2 format. Open LAS file to a ReadableStream.
Version 1.0.18 Update to use latest version of proj4 js library Markdown updates thanks @martinheidegger Fixed strict mode issue thanks @sanoel
Version 1.0.15 Some special handling for Florida data
Version 1.0.14 Fixed bug in CT_TransverseMercator triggering error.
Version 1.0.12 Updated Parser with support for PROJCS WKT and better GEOTiff support
Version 1.0.5 December 12, 2016
Fixed Vertical Unit Projection problem Added conversion for vertical units to meters.
Improved error handling in cases where the projection is not properly included in the variable length records
const fs = require("fs");
const las = require('LasStreamReader');
const lasStream = new las.LasStream(options);
/* Handle Events */
lasStream.on("error", (error)=> {
console.log("error", error);
});
lasStream.on("onParseHeader", (header)=>{
//show the header when parsed
console.log(header);
});
lasStream.on("onParseVLR", (vlr) => {
//the variable length records
});
lasStream.on("onGotProjection", (projection)=> {
console.log("onGotProjection");
console.log(projection);
});
lasStream.on("onFinishedReadingRecords", (count)=> {
console.log(`got ${count} records`);
});
const myWritableStream = createWritableSomehow();
var rs = fs.createReadStream("my_las_file.las", {autoClose : true});
rs.pipe(lasStream).pipe(myWritableStream());
/*
myWritableStream receives an array of point_record objects.
*/
LasStreamReader may be created with the following options passed to the constructor.
Default: true
When processing points transform the cartesian coordinates (xyz) into wgs84 longitude and latitude using the projection specified
Default: use projection specified in the variable length records if available
Some vendors output LAS 1.2 without the required variable length records indicating the LASF projection.
This library uses proj4 to provide the underlying transform. I have included proj4 strings from http://spatialreference.org/ and stored them in epsg.json
const options = {
transform_lnglat : true,
projection : {
epsg_datum : '' //the EPSG datum code e.g. 26905
}
}
const lasStream = new las.LasStream(options);
Emitted when a error occurs.
Emitted when LasStreamReader finishes reading the header data for the las file. Provides a Header object.
Emitted when LasStreamReader completes parsing of the variable length records. Returns an array of VariableLengthRecord objects
When a projection is not provided in the constructor, LasStreamReader will attempt to identify the correct projection using the variable length records. This event fires when that determination is made and provides a Projection object.
When LasStreamReader has parsed all PointRecords this event will fire with a count of records parsed.
The ReadableStream sends an array of PointRecords as it reads through the chunks of the file.
See LAS specification for more details
These map to the
FAQs
Library to read LAS formatted lidar datafiles
The npm package LasStreamReader receives a total of 22 weekly downloads. As such, LasStreamReader popularity was classified as not popular.
We found that LasStreamReader demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.