
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
make-geo-json
Advanced tools
Converts polylines, wkts, wkbs, polygons, circles, rectangles, as well as standard geoJSON into geoJSON MultiPolygon Feature Objects. Converts wkb_list and FeatureCollection to arrays.
Converts polylines, wkts, wkbs, polygons, circles, rectangles, googlePolys, as well as standard geoJSON into geoJSON MultiPolygon Feature Objects. Includes poly area (calculated in square miles). Converts FeatureCollection and KMLs into arrays of geoJSON MultiPolygon Feature Objects.
Can be used as npm package or AWS Lambda.
makeGeoJSON receives two parameters, "type" and "poly".
Options for type include:
Poly will be passed in as a string, object, or array of objects, depending on the type String:
https://console.aws.amazon.com/lambda/home?region=us-east-1#/functions/make-geo-json?tab=graph
arn:aws:lambda:us-east-1:498598553520:function:make-geo-json
Pass in event with this structure:
{
"type": :string,
"poly": :string (for polyline, wkt, wkb, polygon, circle, rectangle)
:object (for googlePolys, geoJSON, FeatureColletion)
:array of objects (for kml)
:array of strings (for wkb_list)
}
npm i --save make-geo-json
import { makeGeoJSON } from 'make-geo-json';
makeGeoJSON(poly.type, poly,data)
npm i --save lodash
npm i --save wkx
lodash - https://www.npmjs.com/package/lodash
wkx - https://www.npmjs.com/package/wkx
const polyline = {
type: 'polyline',
data: 'polylinestringdata',
};
makeGeoJSON(polyline.type, polyline.data);
outputs:
{ type: 'Feature',
properties: {
area: number,
whateverelse: "You put here",
},
geometry: {
type: 'MultiPolygon',
coordinates: [[[
[long, lat],
[long, lat],
]]],
},
}
Also see test/ for more examples.
Any single point poly is converted to a circle with a 75 meter radius. Any two point poly is converted into a rectangle. Any three point plus, open linestring is closed.
Output comes in the form of a MultiPolygon Feature Object. With the exceptions of kml and FeatureCollection, which return as an aray of Multipolygon Feature Objects.
Use claudia test-lambda --event event.json to test lambda. Must have claudia.js installed on machine.
Use npm test to run jest tests.
FAQs
Converts polylines, wkts, wkbs, polygons, circles, rectangles, as well as standard geoJSON into geoJSON MultiPolygon Feature Objects. Converts wkb_list and FeatureCollection to arrays.
We found that make-geo-json demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.