
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
record-locator
Advanced tools
A record locator is short, easy to read and pronounceable string. This module encodes integers into record locator strings and can decode them back into integers.
A Node.js module that encodes integers into a short, easy to read and pronounceable string.
A record locator is an alphanumeric string that represents an integer.
A record locator can be used to provide a human-readable representation of a database primary key, providing users with a short, easy-to-read and pronounceable string. Record locators can be useful when you need to generate a document reference, confirmation number, reservation number or a booking reference to share with your users.
DKHR uses record locators to provide Taxfox customers with an easy way to reference PDF documents associated to them.
8128 encodes to the record locator 9Y23141592 encodes to the record locator 4ZVYR355688197484 encodes to the record locator DEADBEEFYou can encode more than 33.5 million integers in a five-character record locator: the largest five-character record locator, ZZZZZ, represents the integer 33554431.
For more information, see Wikipedia's record locator article.
Use Node.js's default package manager (npm) to install the record-locator module into your project:
npm install --save record-locator
Encoding an integer into a record locator string:
var recordLocator = require('record-locator');
var documentId = 3141592;
var documentReference = recordLocator.encode(documentId);
// console.log output: 4ZVYR
console.log(documentReference);
Decoding a record locator string back into an integer:
var recordLocator = require('record-locator');
var documentReference = '4ZVYR';
var documentId = recordLocator.decode(documentReference);
// console.log output: 3141592
console.log(documentId);
The record-locator module will throw an exception error under the following circumstances:
encode() or decode() is called with no argumentencode() or decode() is called with an empty valueencode() is called with a value that is not numberencode() is called with a value that is not a positive integerYou can use a standard try/catch block to handle these error scenarios:
var recordLocator = require('record-locator');
var invalidDocumentId = -12345;
var documentReference;
try {
documentReference = recordLocator.encode(invalidDocumentId);
} catch (e) {
// console.log output: [Error: Argument is not a positive integer]
console.log(e);
}
For more information on error handling, see Joyent's reference: Error Handling in Node.js
Certain characters, such as the letters "B" and "S", as well as the numbers 0 (zero) and 1 (one), are not used in record locators as there is the potential for confusion with other characters.
These specific characters are automatically replaced by encode() and decode() as follows:
| Character | Replacement Letter |
|---|---|
| B | P |
| S | F |
| 0 | O |
| 1 | I |
The following third-party libraries provide alternative implementations that can also be used to encode and decode record locators:
FAQs
A record locator is short, easy to read and pronounceable string. This module encodes integers into record locator strings and can decode them back into integers.
We found that record-locator demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.