
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
k-dimensional_tree
Advanced tools
Implementation of k-dimensional tree with no dependencies for multi purpose. Common uses are: search in multisemensional spaces (range searches and nearest neighbor searches).
k-dimensional tree in data structure is a type of binary tree in which each leaf of the tree represents a point in a space of k dimensions.
This structure allows for very useful kinds of operations with an interesting computational cost. For instance, finding the post office closest to a certain point can be a hard task if the number of post offices is very large. A search for the nearest neighbor in a k-dimensional solves this problem with a computational cost of O (log n) in the average case.
$ npm i k-dimensional_tree
const {KdTree, Point, Rect} = require('k-dimensional_tree');
// makes a KdTree for two dimensions
const kdt = new KdTree(2);
kdt.insert(new Point([0.5, 0.3]));
kdt.insert(new Point([0.4, 0.01]));
console.log(kdt.nearest(new Point([0.01, 2])));
console.log(kdt.range(new Rect(new Point([0.01, 0.1]), new Point([0.5, 0.35]))));
console.log(kdt.pointsInRadius(new Point([0.01, 2]), 0.075));
Create point in tree
kdt.insert(new Point([0.5, 0.3]));
Check if point p exists in k-dimention tree
kdt.contains(new Point([0.5, 0.3]));
Get numbet of points in k-dimentional tree
kdt.contains();
Check if k-dimention tree is empty
kdt.isEmpty();
Get all points in k-dimentional tree
kdt.nodes();
Get nearest neighbor point of p point
kdt.nearest(new Point([0.01, 2]));
Query points inside rectangle
kdt.range(new Rect(new Point([0.01, 0.1], new Point([0.5, 0.35]))));
Query all points inside radius from a p point
kdt.pointsInRadius(new Point([0.01, 2]), 0.075)
FAQs
kdtree data structure
We found that k-dimensional_tree demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.