
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
Node.js client for Locus — typed access to the differentiator verbs (geo, sketches, CAS, secondary index) plus the reactive changefeed and live geofencing that a plain Redis driver can't surface.
The Node.js client for Locus. Any Redis driver works against Locus for standard commands — this package adds the two things a plain driver can't give you ergonomically:
redis.call(...).ioredis doesn't
model, so the client owns a dedicated connection and parses the frames for you.It wraps ioredis (exposed as .redis) — it does not reimplement RESP.
npm install locusdb ioredis
import { LocusClient } from "locusdb";
const locus = new LocusClient({ host: "127.0.0.1", port: 6379 });
// Standard Redis: the raw ioredis connection is right there.
await locus.redis.set("hello", "world");
// Differentiator verbs, typed:
await locus.geoSet("driver:7", 13.36, 38.11, { status: "free" });
const hits = await locus.geoSearch({
fromLonLat: [13.4, 38.1],
byRadius: [50, "km"],
withDist: true,
where: { status: "free" }, // attribute filter
});
// hits -> [{ key: "driver:7", dist: 3.67 }]
await locus.bfAdd("seen", "msg-42"); // 1 new, 0 probably-duplicate
await locus.cas("flag", "old", "new"); // atomic check-and-set
await locus.idxCreate("by_status", "status");
await locus.idxGet("by_status", "paid"); // -> ["order:1"]
const feed = locus.changefeed("user:"); // optional key prefix
feed.on("ready", ({ count, offset }) => console.log("snapshot done", count));
feed.on("change", (c) => console.log(c.op, c.key, c.value)); // write | del | expire
// ...later
feed.close();
const fence = locus.geofence(13.4, 38.1, 5, "km");
fence.on("enter", (m) => console.log("entered", m.key, m.value)); // "lon,lat"
fence.on("move", (m) => console.log("moved", m.key, m.value));
fence.on("leave", (m) => console.log("left", m.key));
Both run on their own connection; the snapshot ("snapshot" events, then
"ready") precedes live updates, so there's no gap or duplicate.
let since = 0;
for (;;) {
const batch = await locus.clusterCdcMerge(since, 100); // global HLC order
for (const c of batch) { handle(c); since = c.hlc; }
if (!batch.length) await new Promise((r) => setTimeout(r, 250));
}
cdcRead) and consumer groups work over the normal
connection and need server retention (LOCUS_CDC_MAXLEN). The push API above
does not.tls option; the subscription connection honors it too.Run the example against a local server: node examples/quickstart.cjs (after
npm run build).
FAQs
Node.js client for Locus — typed access to the differentiator verbs (geo, sketches, CAS, secondary index) plus the reactive changefeed and live geofencing that a plain Redis driver can't surface.
We found that locusdb demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.