
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
@adv-ui/re-universal-consents-cookies-widget
Advanced tools
Add the next code on the <head> of your website in order to show the Consent Cookies Widget in case it's needed for the user.
<!-- DIDOMI STUB -->
<script type="text/javascript">(function(){function i(e){if(!window.frames[e]){if(document.body&&document.body.firstChild){var t=document.body;var n=document.createElement("iframe");n.style.display="none";n.name=e;n.title=e;t.insertBefore(n,t.firstChild)}else{setTimeout(function(){i(e)},5)}}}function e(n,o,r,f,s){function e(e,t,n,i){if(typeof n!=="function"){return}if(!window[o]){window[o]=[]}var a=false;if(s){a=s(e,i,n)}if(!a){window[o].push({command:e,version:t,callback:n,parameter:i})}}e.stub=true;e.stubVersion=2;function t(i){if(!window[n]||window[n].stub!==true){return}if(!i.data){return}var a=typeof i.data==="string";var e;try{e=a?JSON.parse(i.data):i.data}catch(t){return}if(e[r]){var o=e[r];window[n](o.command,o.version,function(e,t){var n={};n[f]={returnValue:e,success:t,callId:o.callId};if(i.source){i.source.postMessage(a?JSON.stringify(n):n,"*")}},o.parameter)}}if(typeof window[n]!=="function"){window[n]=e;if(window.addEventListener){window.addEventListener("message",t,false)}else{window.attachEvent("onmessage",t)}}}e("__tcfapi","__tcfapiBuffer","__tcfapiCall","__tcfapiReturn");i("__tcfapiLocator")})();</script>
<script defer src='https://unpkg.com/@adv-ui/re-universal-consents-cookies-widget/umd/index.js'></script>
‼️ Do not duplicate the first line(stub) several times. It's only needed once.
Also, you need to have a div element with the needed id where the widget will be rendered. Please, try to keep this div on the root level of your body in order to avoid problems with the modal.
<div id="adevinta_consents_cookies_universal_widget"></div>
When the user accepts or rejects it, the modal will disappear.
Check a working demo: https://codesandbox.io/s/long-star-62xc9?file=/index.html
You must offer to the user the possibility to open the widget to change the consents anytime. For that, you could add this HTML in order to give this feature to the user.
<a
href="#"
alt="Gestionar consentimientos de cookies"
onclick="window.__callUniversalConsentsCookiesWidget()"
>Gestionar consentimientos de cookies</a
>
You could config some aspects of the widget by using a window object called universalConsentsCookiesWidget.
Important: Config should be placed BEFORE loading the widget.
<script>
window.__mpi.universalConsentsCookiesWidget = {
cookiePolicyUrl: 'https://your-domain.com/cookie-policy?disable-cmp',
logo: 'https://your-domain.com/logo.png',
site: 'fotocasa'
}
</script>
<script defer src='https://unpkg.com/@adv-ui/re-universal-consents-cookies-widget/umd/index.js'></script>
site The allowed sites are a map to resolve the notice id. Check here
If you consider that you need to add a new site(because some configuration is different than the vertical main site), please, contact with the team owner of CMP.
cookiePolicyUrl
🚧 This is not working properly now. The cookie policy is set in the notice on the Didomi console.
disable-cmp query param to disable the CMP if it's included in the cookie policy pageThe widget comes with Segment Wrapper. You only need to add the needed snippet for Segment SDK with the expected write key in order to use it. This needs to be done before loading the widget.
After that, you could safely use the window.sui.analytics method in order to track with Segment Wrapper and it will send the correct tracking with the consents well informed.
This snippet should be placed BEFORE the one mentioned before.
<script>
!function(){var analytics=window.analytics=window.analytics||[];if(!analytics.initialize)if(analytics.invoked)window.console&&console.error&&console.error("Segment snippet included twice.");else{analytics.invoked=!0;analytics.methods=["trackSubmit","trackClick","trackLink","trackForm","pageview","identify","reset","group","track","ready","alias","debug","page","once","off","on"];analytics.factory=function(t){return function(){var e=Array.prototype.slice.call(arguments);e.unshift(t);analytics.push(e);return analytics}};for(var t=0;t<analytics.methods.length;t++){var e=analytics.methods[t];analytics[e]=analytics.factory(e)}analytics.load=function(t,e){var n=document.createElement("script");n.type="text/javascript";n.async=!0;n.src="https://cdn.segment.com/analytics.js/v1/"+t+"/analytics.min.js";var a=document.getElementsByTagName("script")[0];a.parentNode.insertBefore(n,a);analytics._loadOptions=e};analytics.SNIPPET_VERSION="4.1.0";
analytics.load("YOUR_WRITE_KEY"); // your write key must be set here
}}();
</script>
<script>
window.onload = () => {
window.sui.analytics.identify('your user id', {});
window.sui.analytics.track('Your Event', {});
window.sui.analytics.reset();
}
</script>
You could then use the config from Segment Wrapper. This should be placed before loading the widget.
<script>
window.__mpi = {
segmentWrapper: {
googleAdsPixelId: '1054970353',
facebookPixelId: '448176625351232',
importAdobeVisitorId: true,
defaultProperties: {
site: 'infojobs'
}
}
}
</script>
Once you have the consents widget implemented in your site, you'll be able to listen when the user has consented some purposes in order to load some specific tags.
For example, for adding loading tealium after user is giving consents you should do:
<script>
// init vendors loader by consents
window.onload = () => {
window.sui.vendors.initVendorConsentsLoader({
vendors: {
tealium: {
// script to load
script: 'https://frtassets.fotocasa.es/external-scripts/utag-pro.js',
// consents needed for this script
consents: {
purposes: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10],
specialFeatureOptins: [1]
}
},
addThis: {
// script to load
script: 'https://www.addthis.com/script.js',
// consents needed for this script
consents: {
purposes: [1], // example of a script with a single purpose
specialFeatureOptins: [1]
}
}
}
})
}
</script>
Please, keep in mind that if the user doesn't provide needed consents the script won't be loaded.
FAQs
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.