
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
A lightweight package to retrieve detailed geolocation data from an IP address, including country code, flag emoji, city, region, timezone, currency, and more, using the ipapi.co API. Supports automatic IP detection for client-side and server-side applica
A lightweight package to retrieve detailed geolocation data from an IP address, including country code, flag emoji, city, region, timezone, currency, and more. Supports automatic IP detection for client-side and server-side applications.
npm install geoip-flag
Call getLocationByIP()
without an IP address to automatically detect the user's public IP address:
import { getLocationByIP } from 'geoip-flag';
async function getUserLocation() {
try {
const location = await getLocationByIP();
console.log(location);
// Example output:
// {
// ip: '8.8.8.8',
// city: 'Mountain View',
// region: 'California',
// region_code: 'CA',
// country_code: 'US',
// country_code_iso3: 'USA',
// country_name: 'United States',
// country_capital: 'Washington',
// country_tld: '.us',
// continent_code: 'NA',
// in_eu: false,
// postal: '94035',
// latitude: 37.386,
// longitude: -122.0838,
// timezone: 'America/Los_Angeles',
// utc_offset: '-0700',
// country_calling_code: '+1',
// currency: 'USD',
// currency_name: 'Dollar',
// languages: 'en-US,es-US,haw',
// asn: 'AS15169',
// org: 'Google LLC',
// countryFlag: '🇺🇸'
// }
} catch (error) {
console.error(error.message);
}
}
getUserLocation();
Extract the client's IP address from the HTTP request and pass it to getLocationByIP(ipAddress)
:
const express = require('express');
const { getLocationByIP } = require('geoip-flag');
const app = express();
app.set('trust proxy', true); // Enable if behind a proxy like Nginx
app.get('/location', async (req, res) => {
try {
const clientIp = req.headers['x-forwarded-for'] || req.socket.remoteAddress;
const location = await getLocationByIP(clientIp);
res.json(location);
} catch (error) {
res.status(500).json({ error: error.message });
}
});
app.listen(3000, () => console.log('Server running on port 3000'));
Provide an IP address explicitly to get geolocation data for that IP:
const { getLocationByIP } = require('geoip-flag');
async function getLocation() {
try {
const location = await getLocationByIP('8.8.8.8');
console.log(location);
} catch (error) {
console.error(error.message);
}
}
getLocation();
The package includes type definitions for TypeScript:
import { getLocationByIP } from 'geoip-flag';
async function getUserLocation() {
try {
const location = await getLocationByIP();
console.log(location);
} catch (error) {
console.error(error instanceof Error ? error.message : 'Unknown error');
}
}
getUserLocation();
X-Forwarded-For
headers if behind a proxy).MIT
FAQs
A lightweight package to retrieve detailed geolocation data from an IP address, including country code, flag emoji, city, region, timezone, currency, and more, using the ipapi.co API. Supports automatic IP detection for client-side and server-side applica
The npm package geoip-flag receives a total of 4 weekly downloads. As such, geoip-flag popularity was classified as not popular.
We found that geoip-flag demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.