
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
pokespotter
Advanced tools
This module allows you to easily determine the Pokemon that are around a certain location. It uses the Node.js wrapper for the Pokemon GO API.
npm install pokespotter --save
You need either a Google account or Pokemon Trainer Club account. Best save these as environment variables:
| Variable | Purpose |
|---|---|
| PGO_USERNAME | Your Pokemon GO / Google username |
| PGO_PASSWORD | Your Pokemon GO / Google password |
| PGO_PROVIDER | 'ptc' for Pokemon Trainer Club or 'google' for Google |
var Pokespotter = require('pokespotter')(); // add username, password, provider if necessary
var Pokespotter = require('pokespotter')('username@gmail.com', 'mypassword', 'google');
Pokespotter.get('Central Park, New York').then(function (pokemon) {
console.log(pokemon);
});
Pokespotter(username, password, provider) ⇒ PokespotterInitializer for Pokespotter. Credentials can be passed as arguments or stored in the ENV variables: PGO_USERNAME, PGO_PASSWORD, PGO_PROVIDER
| Param | Type | Description |
|---|---|---|
| PGO_USERNAME | string | Your Pokemon GO / Google username |
| PGO_PASSWORD | string | Your Pokemon GO / Google password |
| PGO_PROVIDER | string | 'ptc' for Pokemon Trainer Club or 'google' for Google |
Pokespotter methodsget(location, options) ⇒ Promise<Pokemon[]>Gets all the Pokemon around a certain location. The location can be latitude, longitude or an address that will be checked with Open Street Map.
| Param | Type | Description |
|---|---|---|
| location | string | Location |
| options | GetOptions | Options to alter call behavior |
getNearby(location, options) ⇒ Promise<Pokemon[]>Alias for get(location, options)
PokedexArray of all Pokemon with their Pokedex number as index.
getMapsUrl() ⇒ string| Param | Type | Description |
|---|---|---|
| center | string or Location | Central location of the map |
| pokemon | Pokemon[] | List of Pokemon to mark on the map |
| steps | number | The amount of steps used to search |
| size | string | Size of the map. Default 512x512 |
Location| Field | Type | Description |
|---|---|---|
| longitude | number | Location longitude |
| latitude | number | Location latitude |
GetOptions| Field | Type | Description |
|---|---|---|
| steps | number | Number of steps the API should explore in each direction from the base |
| requestDelay | number | Timeout in milliseconds before each API call. Needed for more steps. |
Pokemon| Field | Type | Description |
|---|---|---|
| spawnPointId | string | Internal ID for the place a Pokemon spawned |
| longitude | number | Longitude of the current location of a Pokemon |
| latitude | number | Latitude of the current location of a Pokemon |
| expirationTime | number | UNIX timestamp in milliseconds when a Pokemon disappears |
| pokemonId | number | Official Pokedex Number |
| name | string | English name of Pokemon |
| distance | number | Distance in meters to the requested location |
The used API wrapper uses an unofficial Niantic API. They might block you for using this. Therefore it is not recommended to use this or any other API with your actual account.
FAQs
Node module for finding Pokemon in Pokemon Go
We found that pokespotter demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.