Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Mini-OpenWeatherMap is a wrapper around Open Weather Map's One Call Api.
Configure it via initialization, chainging, individual calls, or mix and match.
mini-owm also simplifies the Open Weather Api by:
1h
property from rain
and snow
directly to those properties - who starts a json property with a number? rain
or snow
to 0
instead of omittingnpm install mini-owm
import MiniOwm, { Units } from 'mini-owm';
// constructor parameters are all optional
const api = new MiniOwm(
'<your api key here>', // owm api key
33.441792, // latitude
-94.037689, // longitude
'hourly,minutely' // exclude
Units.Imperial, // units (default is 'metric' for mini-owm)
'de' // language
);
api.get().then(res => {
console.log(res);
});
import MiniOwm from 'mini-owm';
const api = new MiniOwm();
api
.apiKey('<your api key here>')
.latitude(33.441792)
.longitude(-94.037689)
.exclude('hourly,minutely')
.standard() // set units to standard (Kelvin)
.imperial() // set units to imperial (Fahrenheit)
.metric() // set units to metric (Celcius) - this is default for mini-owm
.language('de')
.get()
.then(res => {
console.log(res);
});
import MiniOwm, { Units } from 'mini-owm';
new MiniOwm()
.get({
apiKey: '<your api key here>',
coords: {
latitude: 33.441792,
longitude: -94.037689,
},
exclude: 'hourly,minutely',
units: Units.Metric, // or 'metric'
language: 'de',
})
.then(res => {
console.log(res);
});
pnpm install
.env
with contents: API_KEY=<your api key here>
pnpm run start
See index.ejs.
Latest tested runtimes
FAQs
Mini ES wrapper for OpenWeatherMap api
The npm package mini-owm receives a total of 1 weekly downloads. As such, mini-owm popularity was classified as not popular.
We found that mini-owm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.