
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
gpx-basic-stats
Advanced tools
Computes the distance, duration, and elevation gain for GPX routes.
Statistics are created for each trkseg in a GPX file (most GPX files have a single trkseg). Elevation data must be supplied in the GPX data (no external elevation APIs are used in the calculcation). The final result will be in the same units as the source data (e.g. meters, feet).
npm i --save gpx-basic-stats
// load dependencies
const gpxBasicStats = require('gpx-basic-stats')
const fs = require('fs')
// open sample file
const sampleFile = fs.readFileSync('./sample_data/Sample_Joaquin_Miller.gpx', 'utf8')
// calculate elevation (in same units as source data)
const statistics = gpxBasicStats( sampleFile )
Returns an array of statistics calcuations, one for each trkseg in the GPX file. For example:
[
{
startTime: "2019-11-02T17:49:50Z",
endTime: "2019-11-02T19:15:26Z",
distance: 2.83252139802459,
duration: 5136000,
elevationGain: 172.90000000000026,
successful: 1,
message: "Statistics calculated successfully.",
}
]
nvm use
npm install
npm test
This build is published to the @gritto NPM Registry at dev.gritto.net. Ensure your ~/.npmrc file contains configuration for this namespace:
; @gritto NPM registry publish (per project)
//dev-npm-publish.gritto.net/api/v4/projects/64/packages/npm/:_authToken=<gitlab-gritto-group-deploy-token>
This configuration will overlay the publishConfig specified in the package.json file with the proper auth token.
It would be great to include a "Moving Time" calculation similar to what Strava does. Also better error handling for GPX data that contains some data elements but not others.
FAQs
Calculates basic statistics for GPX routes
We found that gpx-basic-stats demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.