Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
This is a little Javascript library that allows you to look up the time zone of a location given its latitude and longitude. It works in both the browser and in Node.JS, and is very fast and lightweight (~71KB) given what it does. We use it in production for The Dark Sky API.
To install:
npm install tz-lookup
Node.JS usage:
var tzlookup = require("tz-lookup");
console.log(tzlookup(42.7235, -73.6931)); // prints "America/New_York"
Browser usage:
<script src="tz.js"></script>
<script>
alert(tzlookup(42.7235, -73.6931)); // alerts "America/New_York"
</script>
Please take note of the following:
The exported function call will throw an error if the latitude or longitude provided are NaN or out of bounds. Otherwise, it will never throw an error and will always return an IANA timezone database string. (Barring bugs.)
The timezones returned by this module are approximate: since the timezone database is so large, lossy compression is necessary for a small footprint and fast lookups. Expect errors near timezone borders far away from populated areas. However, for most use-cases, this module's accuracy should be adequate.
If you find a real-world case where this module's accuracy is inadequate, please open an issue (or, better yet, submit a pull request with a failing test) and I'll see what I can do to increase the accuracy for you.
Timezone data is sourced from Evan Siroky's timezone-boundary-builder. The database was last updated on 6 Jan 2019.
To regenerate the library's database yourself, you will need to install GDAL:
$ brew install gdal # on Mac OS X
$ sudo apt install gdal-bin # on Ubuntu
Then, simply execute rebuild.sh
. Expect it to take 10-30 minutes, depending
on your network connection and CPU.
To the extent possible by law, The Dark Sky Company, LLC has waived all copyright and related or neighboring rights to this library.
FAQs
fast time zone lookup
We found that tz-lookup demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.