
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
react-native-contains-location
Advanced tools
Native module to calculate if my current coordinates are in some specific area
$ npm install react-native-contains-location --save
pod init, if you don't have cocoapods installed sudo gem install cocoapods# Uncomment the next line to define a global platform for your project
platform :ios, '9.0'
target 'YOURE_APP_NAME' do
# Uncomment the next line if you're using Swift or would like to use dynamic frameworks
# use_frameworks!
# Pods for contains
pod 'React', :path => '../node_modules/react-native', :subspecs => [
'Core',
'CxxBridge', # Include this for RN >= 0.47
'DevSupport', # Include this to enable In-App Devmenu if RN >= 0.43
'RCTText',
'RCTNetwork',
'RCTWebSocket', # Needed for debugging
'RCTAnimation', # Needed for FlatList and animations running on native UI thread
# Add any other subspecs you want to use in your project
]
# Explicitly include Yoga if you are using RN >= 0.42.0
pod 'yoga', :path => '../node_modules/react-native/ReactCommon/yoga'
# Third party deps podspec link
pod 'DoubleConversion', :podspec => '../node_modules/react-native/third-party-podspecs/DoubleConversion.podspec'
pod 'glog', :podspec => '../node_modules/react-native/third-party-podspecs/glog.podspec'
pod 'Folly', :podspec => '../node_modules/react-native/third-party-podspecs/Folly.podspec'
# THE PATH TO INSTALL DEPENDENCIES FROM THE MODULE
pod 'RNContainsLocation', path: '../node_modules/react-native-contains-location'
end
.xcworkspace inside the ios folder, clean the project and then build and restart you're server npm start --reset-cacheIN CASE OF THE XCODE SHOW THIS ERROR <GoogleMaps/GMSGeometryUtils.h> not found
restart you're machine or close the xcode and open again and try again.
android/app/src/main/java/[...]/MainActivity.javaimport com.reactlibrary.RNContainsLocationPackage; to the imports at the top of the filenew RNContainsLocationPackage() to the list returned by the getPackages() methodandroid/settings.gradle:
include ':react-native-contains-location'
project(':react-native-contains-location').projectDir = new File(rootProject.projectDir, '../node_modules/react-native-contains-location/android')
android/app/build.gradle:
compile project(':react-native-contains-location')
import { containsLocation } from 'react-native-contains-location';
var polygon = [
{ lat: 3.1336599385978805, lng: 101.31866455078125 },
{ lat: 3.3091633559540123, lng: 101.66198730468757 },
{ lat: 3.091150714460597, lng: 101.92977905273438 },
{ lat: 2.7222113428196213, lng: 101.74850463867188 },
{ lat: 2.7153526167685347, lng: 101.47933959960938 },
{ lat: 3.1336599385978805, lng: 101.31866455078125 }
]
navigator.geolocation.getCurrentPosition(
(position) => {
let point = {
lat: position.coords.latitude,
lng: position.coords.longitude
}
containsLocation(point, polygon)
.then(response => {
// if the promise was success return TRUE
console.log('Im inside of the polygon?', response)
})
.catch(error => {
//only return FALSE if the point is not inside of the polygon
console.log('Im inside of the polygon?', error)
})
},
(error) => alert(error.message),
{ enableHighAccuracy: true, timeout: 20000, maximumAge: 1000 }
)
FAQs
Native module to calculate if my current coordinates are in some specific area
We found that react-native-contains-location demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.