
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
huff
Advanced tools

This Python library is designed for performing market area analyses with the Huff Model (Huff 1962, 1964) and/or the Multiplicative Competitive Interaction (MCI) Model (Nakanishi and Cooper 1974, 1982). The package is especially intended for researchers in economic geography, regional economics, spatial planning, marketing, geoinformation science, and health geography. It is designed to cover the entire workflow of a market area analysis, including model calibration and GIS-related processing. Users may load point shapefiles (or CSV, XLSX) of customer origins and supply locations and conduct a market area analysis step by step. The first step after importing is always to create an interaction matrix with a built-in function, on the basis of which all implemented models can then be calculated. The library supports parameter estimation based on empirical customer data using the MCI model or Maximum Likelihood estimation. See Huff and McCallum (2008), Orpana and Lampinen (2003) and Wieland (2017) for a description of the models, their practical application and fitting procedures. Additionally, the library includes functions for accessibility analysis, which may be combined with market area analysis, namely the Hansen accessibility (Hansen 1959) and the Two-step floating catchment area analysis (Luo and Wang 2003). The package also includes auxiliary GIS functions for market area analysis (buffer, distance matrix, overlay statistics) and clients for OpenRouteService(1) for network analysis (e.g., transport cost matrix) and OpenStreetMap(2) for simple maps. All auxiliary functions are implemented in the market area analysis functions but are also able to be used stand-alone.
A software paper describing the library is available at arXiv
If you use this software, please cite:
Wieland, T. (2026). huff: Market Area Analysis in Python (Version 1.8.6) [Computer software]. Zenodo. https://doi.org/10.5281/zenodo.18639559
To install the package from the Python Package Index (PyPI), use pip:
pip install huff
To install the package from GitHub with pip:
pip install git+https://github.com/geowieland/huff_official.git
(1) © openrouteservice.org by HeiGIT | Map data © OpenStreetMap contributors | https://openrouteservice.org/
(2) © OpenStreetMap contributors | available under the Open Database License | https://www.openstreetmap.org/
# Workflow for basic Huff model analysis:
from huff.data_management import load_geodata
from huff.models import create_interaction_matrix
Haslach = load_geodata(
"data/Haslach.shp",
location_type="origins",
unique_id="BEZEICHN"
)
# Loading customer origins (shapefile)
Haslach.define_marketsize("pop")
# Definition of market size variable
Haslach.define_transportcosts_weighting(
func = "power",
param_lambda = -2.2,
)
# Definition of transport costs weighting (lambda)
Haslach.summary()
# Summary after update
Haslach_supermarkets = load_geodata(
"data/Haslach_supermarkets.shp",
location_type="destinations",
unique_id="LFDNR"
)
# Loading supply locations (shapefile)
Haslach_supermarkets.define_attraction("VKF_qm")
# Defining attraction variable
Haslach_supermarkets.define_attraction_weighting(
param_gamma=0.9
)
# Define attraction weighting (gamma)
Haslach_supermarkets.summary()
# Summary of updated customer origins
haslach_interactionmatrix = create_interaction_matrix(
Haslach,
Haslach_supermarkets
)
# Creating interaction matrix
haslach_interactionmatrix.transport_costs(
ors_auth="5b3ce3597851110001cf62487536b5d6794a4521a7b44155998ff99f",
network=True,
)
# Obtaining transport costs (default: driving-car)
# set network = True to calculate transport costs matrix via ORS API (default)
# ORS API documentation: https://openrouteservice.org/dev/#/api-docs/v2/
haslach_interactionmatrix.summary()
# Summary of interaction matrix
haslach_interactionmatrix.flows()
# Calculating spatial flows for interaction matrix
huff_model = haslach_interactionmatrix.marketareas()
# Calculating total market areas
# Result of class HuffModel
huff_model.summary()
# Summary of Huff model
haslach_interactionmatrix.plot(
origin_point_style = {
"name": "Districts",
"color": "black",
"alpha": 1,
"size": 100,
},
location_point_style = {
"name": "Supermarket chains",
"color": {
"Name": {
"Aldi Süd": "blue",
"Edeka": "yellow",
"Lidl": "red",
"Netto": "orange",
"Real": "darkblue",
"Treff 3000": "fuchsia"
}
},
"alpha": 1,
"size": 100
},
)
# Plot of interaction matrix with expected customer flows
For detailed examples, see the /examples folder in the public GitHub repository.
This software was developed without the use of AI-generated code. The Continue Agent in Microsoft Visual Studio Code using the GPT-5 mini model (by OpenAI) was used solely to assist in drafting and refining docstrings for documentation.
FAQs
huff: Market Area Analysis in Python
We found that huff demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.