Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/theo-regis/google-analytics-php2
Sometimes it is impossible to embed the JavaScript tracking code provided by Google Analytics: the host page does not allow arbitrary JavaScript, and there is no Google Analytics integration. However, not all is lost! If you can embed a simple image (pixel tracker), then you can beacon data to Google Analytics.
This is tweaked version of igrigorik/ga-beacon. As the original author suggests:
there are no capacity or availability promises. For best results, deploy your own instance directly on Google App Engine.
Unfortunately, many people don't bother with creating their own instances and we all see this
This repo was created to help you with setting up your own Google Analytis Beacon application, so, you will never have availabiltiy issues like above.
Its usage is also restricted by your onw tracking ids (UA-XXXXXXXX-X
). The file ga-beacon/conf.json
contains a white list of allowed tracking ids. This implies, you have to update the list every time you want to track something with a new tracking id. Leave the list empty, if you don't want to restrict, but keep in mind, with no restrictions anyone can use your application instance for tracking their visitors and you may pay for that. Here an example of ga-beacon/conf.json
{
"TrackingIds": ["UA-XXXXXXXX-X","UA-YYYYYYYY-Y,"UA-ZZZZZZZZ-Z"]
}
You may also auto-calculate the tracking path based in the "referer" information of the image. To activate this simple add ?useReferrer
to the image URL (or &useReferer
if you need to combine this with the ?pixel
, ?flat
or ?flat-gif
parameter). Although they are some odd browsers that don't always send the referer header, the amount of traffic coming from those browsers is usually not relevant at all. Of course that if you need to measure the traffic from those odd browsers you should not use this method.
You should deploy this application on your server. Using Google App Engine is free and easiest way to do so. Be aware of GAE free usage limits https://cloud.google.com/appengine/docs/quotas#Requests. If you run over quota, you'll see the image above and lose some stats. Unless you have very popular resource or other people also use your instance for tracking (consider applying the restriction), GAE daily limits are very generous. There are two options for deployment on GAE:
cd ~/src/My-Project-ID/master
gcloud preview app deploy app.yaml --promote
https://cloud.google.com/appengine/downloads#Google_App_Engine_SDK_for_Go
Hello, World! in 5 minutes - Go — Google Cloud Platform
http://stackoverflow.com/questions/32107712/google-app-engine-app-deployment
In my case, I got refused because the appcfg save my ouauth2 token in the file ~/.appcfg_oauth2_tokens, which happen to be another account of appengine . Simply remove the file and try again.
cd $GOPATH
or cd %GOPATH%
on win
appcfg.py -A your_app_name update google-analytics-beacon/
First, log in to your Google Analytics account and set up a new property:
UA-XXXXXXXX-X
ID on next pageNext, add a tracking image to the pages you want to track:
UA-XXXXX-X
should be your tracking IDinsert/any/path
is an arbitrary path. For best results specify a meaningful and self-descriptive path. You have to do this manually, the beacon won't automatically record the page path it's embedded on.Example tracker markup if you are using Markdown:
[![Analytics](https://My-Project-ID.appspot.com/UA-XXXXXXXX-X/insert/any/path)](https://github.com/vitr/google-analytics-beacon)
If you prefer, you can skip the badge and use a transparent pixel. To do so, simply append ?pixel
to the image URL. There are also "flat" style variants available, which are available when appending ?flat
or ?flat-gif
to the image URL. And that's it, add the tracker image to the pages you want to track and then head to your Google Analytics account to see real-time and aggregated visit analytics for your projects!
It's useful to read the original project FAQ
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.