
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
openlayers
Advanced tools
Build tools and sources for developing OpenLayers based mapping applications
OpenLayers is a high-performance, feature-packed library for creating interactive maps on the web. It can display map tiles, vector data and markers loaded from any source on any web page. OpenLayers has been developed to further the use of geographic information of all kinds. It is completely free, Open Source JavaScript, released under the 2-clause BSD License (also known as the FreeBSD).
Use one of the following methods to use OpenLayers in your project:
For use with webpack, Rollup, Browserify, or other module bundlers, install the ol package:
npm install ol
If you just want to add a <script> tag to test things out, you can link directly to one of the full builds from cdnjs (not recommended for production)
For use with Closure Library (rare), install the openlayers package and read the tutorial.
OpenLayers runs on all modern browsers that support HTML5 and ECMAScript 5. This includes Chrome, Firefox, Safari and Edge. For older browsers and platforms like Internet Explorer (down to version 9) and Android 4.x, polyfills for requestAnimationFrame and Element.prototype.classList are required, and using the KML format requires a polyfill for URL.
Check out the hosted examples, the workshop or the API documentation.
Please use the GitHub issue tracker for all bugs and feature requests. Before creating a new issue, do a quick search to see if the problem has been reported already.
Please see our guide on contributing if you're interested in getting involved.
FAQs
Build tools and sources for developing OpenLayers based mapping applications
The npm package openlayers receives a total of 4,107 weekly downloads. As such, openlayers popularity was classified as popular.
We found that openlayers demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.