Socket
Book a DemoInstallSign in
Socket
Book a DemoInstallSign in

@dcard/web-ad-tracking-sdk

Package Overview
Dependencies
Maintainers
7
Versions
16
Alerts
File Explorer

Advanced tools

License
Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

@dcard/web-ad-tracking-sdk

The public advertising tracking SDK for web environments powered by Dcard Inc.

latest
Source
npmnpm
Version
3.0.0
Version published
Weekly downloads
191
-22.98%
Maintainers
7
Weekly downloads
 
Created
Source

Welcome to Dcard Web AD Tracking SDK 👋

NPM version License: MIT

The advertising tracking SDK for web environments powered by Dcard Inc.

🏠 Homepage

Install & Usage

Integrate tracking SDK into your codebase (Support typing automatically in IDE like vscode)

  • Install @dcard/web-ad-tracking-sdk
pnpm add @dcard/web-ad-tracking-sdk
  • Import @dcard/web-ad-tracking-sdk
import entry from '@dcard/web-ad-tracking-sdk';

// Substitute the real client ID for CLIENT_ID issued by Dcard.
entry('init', 'CLIENT_ID');
entry('track', 'PageView', { url: window.location.href });

Embed the SDK in the HTML file

Copy and paste the following script tags within the <head> tag of your HTML file to initialize the web tracking SDK.

<script
  async
  src="https://assets.dcard.tw/scripts/web-ad-tracking-sdk/latest.js"></script>
<script>
  /**
   * ===[[ Section 1 ]]===
   */
  window.dadk =
    window.dadk ||
    function dadk() {
      window.dadk.queue.push(Array.from(arguments));
    };
  window.dadk.queue = window.dadk.queue || [];

  /**
   * ===[[ Section 2 ]]===
   *
   * Change "CLIENT_ID" to your client id
   * e.g. "XXXOOO123456"
   */
  window.dadk('init', 'CLIENT_ID');
  window.dadk('track', 'PageView');
</script>

With Security Resource Integrity (SRI)

If you want to use the script with SRI, you can replace the first script with the following:

- <script async src="https://assets.dcard.tw/scripts/web-ad-tracking-sdk/latest.js"></script>
+ <script async src="https://assets.dcard.tw/scripts/web-ad-tracking-sdk/v3.0.0.js" integrity="sha384-OEa0OLZxesMGpNtP3OvBd1dUrOIEFQK0ofDakusy9o7zMeywjDcN/Ujv7gCCILBz" crossorigin="anonymous"></script>

NOTE: The script tag with SRI will fix the version of the SDK, an this may cause the SDK to be outdated. If you want to keep the SDK up-to-date, please use the latest version script tag.

Setup Content Security Policy (CSP)

Basic Setup
Security Connection
img-src: https://pixel.dcard.tw
script-src: https://pixel.dcard.tw https://assets.dcard.tw/scripts/web-ad-tracking-sdk
Insecurity Connection
img-src: pixel.dcard.tw
script-src: pixel.dcard.tw assets.dcard.tw/scripts/web-ad-tracking-sdk
With Nonce

Revice the Content Security Policy header with nonce attribute:

img-src: https://pixel.dcard.tw
script-src: 'nonce-{SERVER_GENERATED_NONCE}' https://pixel.dcard.tw https://assets.dcard.tw/scripts/web-ad-tracking-sdk

And add the nonce attribute to the script tag:

<script async nonce="SERVER_GENERATED_NONCE" crossorigin="anonymous">
  /**
   * ===[[ Section 1 ]]===
   */
  window.dadk =
    window.dadk ||
    function dadk() {
      window.dadk.queue.push(Array.from(arguments));
    };
  window.dadk.queue = window.dadk.queue || [];

  /**
   * ===[[ Section 2 ]]===
   *
   * Change "CLIENT_ID" to your client id
   * e.g. "XXXOOO123456"
   */
  window.dadk('init', 'CLIENT_ID');
  window.dadk('track', 'PageView');
</script>

FAQs

Package last updated on 11 Feb 2025

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts

Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique

Research

Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique

A malicious package uses a QR code as steganography in an innovative technique.

By Olivia Brown  -  Sep 22, 2025