Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
node-postal
Advanced tools
These are the NodeJS bindings to libpostal, a fast, multilingual NLP library for parsing/normalizing physical addresses. libpostal is written in C because virtually every other language can bind to C.
var postal = require('node-postal');
// Expansion API
postal.expand.expand_address('V XX Settembre, 20');
// Parser API
postal.parser.parse_address('Barboncino 781 Franklin Ave, Crown Heights, Brooklyn, NY 11238');
Before using the Node bindings, you must install the libpostal C library. Make sure you have the following prerequisites:
On Ubuntu/Debian
sudo apt-get install curl autoconf automake libtool pkg-config
On CentOS/RHEL
sudo yum install curl autoconf automake libtool pkgconfig
On Mac OSX
brew install curl autoconf automake libtool pkg-config
Installing libpostal
git clone https://github.com/openvenues/libpostal
cd libpostal
./bootstrap.sh
./configure --datadir=[...some dir with a few GB of space...]
make
sudo make install
# On Linux it's probably a good idea to run
sudo ldconfig
Install node-gyp
Then install node-gyp system-wide:
sudo npm install -g node-gyp
Installing node-gyp on Linux (Ubuntu)
First make sure you have:
sudo apt-get install build-essential
on Ubuntu)Installing the Node bindings
npm install openvenues/node-postal
node-postal is tested on most major versions of Node (0.10+) in continuous integration. The C++ bindings are written using Nan, which abstracts the API changes across various versions of V8, so the latest versions of Node will likely work.
If you're having trouble compiling, post a Github issue with your OS and Node versions along with the output of npm install / node-gyp rebuild.
To run the unit tests:
npm test
Installing libpostal:
node-postal is a thin wrapper around libpostal, which is written in C. Installing node-postal with npm will not install libpostal as a dependency. The install steps described above will install it in standard locations for your OS. For OS X and Linux, that's /usr/local/include
and /usr/local/lib
. node-postal will look in these locations for the C libraries. If you have problems installing node-postal, check there for recently installed libpostal libraries.
Downloading Large Files
The make
process downloads ~750MB of data, ~2GB unzipped (note: these are production-quality machine learning models trained on over a billion addresses, that's how much disk/memory it takes). Make sure the --datadir argument to configure
, which requires an absolute path, has enough room to accommodate the models. If you get errors after downloading, e.g.:
make[3]: *** [all-local] Error 1
make[2]: *** [all-recursive] Error 1
make[1]: *** [all-recursive] Error 1
make: *** [all] Error 2
there may be problems with subsequent install steps. Occasionally something will go wrong and it will give up downloading. Once downloading is complete, the make script will unpack the langauge_classifier.tar.gz.X files. If you see these files, your download may have stopped. Try running the make script again.
Lucas Hrabovsky (https://github.com/imlucas) for information and examples of repos using Nan, node-gyp, etc.
FAQs
International address parsing/normalization at C speed
The npm package node-postal receives a total of 11,961 weekly downloads. As such, node-postal popularity was classified as popular.
We found that node-postal demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.