
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
x5-geometry
Advanced tools
Created by Sint Connexa, aka Rich DeVaul @xnet-mobile and @rdevaul
This folder is the home for the core X5 Hex Grid libraries and some related tools and code conversions. X5 provides the basis for the XNET hex grid system, and differs in important ways in design and implementation from Uber's H3 system. See the X5 Hex Grid documentation for more information.
This folder is also the home to computation geometry tools that are used for the batch processing of geo data in order to build the maps and dictionaries used by the XNET visualizer, and ultimately the on-chain smart-contract implementations.
Here are some of the more interesting contents of this repo:
src/geom.ts — the reference implementation for core X5 hex mapping
src/words2index.ts — map X5 hex indices into three-word names, and vice versa.
python/zip2map.py — a yapCAD-based tool for generating hex tilings of zipcodes
LICENSE — MIT license, which applies to all contents unless otherwise stated
docs — documentation home
assets — images and reference data
src — TypeScript source code
python — Python source code
output — a working directory for the zip2map.py script
For questions about this repo, please jump into the XNET discord server at https://discord.gg/qJFJwkBZwj or email connexa@xnet.company
This repository is also available as an npm package for use in TypeScript/JavaScript projects. See src/README.md for detailed usage instructions.
npm install xnet-geometry
import {
// Geometry functions
haversine,
travel,
grid2latLon,
latLon2grid,
// Word processing
getAdjectiveIndex,
getNounIndex,
ij2string,
string2ij
} from 'xnet-geometry';
// Calculate distance between two points
const distance = haversine(lat1, lon1, lat2, lon2);
// Convert grid coordinates to lat/lon
const [lat, lon] = grid2latLon(i, j);
// Convert lat/lon to grid coordinates
const [i, j] = latLon2grid(lat, lon);
// Convert grid coordinates to word string
const wordString = ij2string(i, j);
// Convert word string back to grid coordinates
const [i, j] = string2ij(wordString);
// Get word indices
const adjIndex = getAdjectiveIndex('beautiful');
const nounIndex = getNounIndex('dinosaur');
haversine(lat1: number, lon1: number, lat2: number, lon2: number): number
travel(lat1: number, lon1: number, Δx: number, Δy: number): [number, number]
grid2latLon(i: number, j: number, maxLat?: number, step?: number, offset?: number): [number, number]
latLon2grid(lat: number, lon: number, maxLat?: number, step?: number, offset?: number): [number, number]
getAdjectiveIndex(word: string): number
getNounIndex(word: string): number
ij2string(i: number, j: number): string
string2ij(string: string): [number, number]
MIT License - see LICENSE file for details.
For questions about this repo, please jump into the XNET discord server at https://discord.gg/qJFJwkBZwj or email connexa@xnet.company
FAQs
Geometry and word processing utilities for XNet
We found that x5-geometry demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.