
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@episerver/telemetry
Advanced tools
A telemetry API for consistent anonymous product feature tracking used in Episerver.
Currently wraps Application Insights JS SDK but this can change to another service or multiple services in the future.
yarn add @episerver/telemetry
npm install @episerver/telemetry
import { Owner, TrackerFactory, ITracker } from "@episerver/telemetry";
The @episerver/telemetry package exports several classes to make telemetry usage consistent across Episerver's products. The main class being TrackerFactory that creates a factory object that can be used once in an application, to create multiple ITracker - one for each owning team.
When only one owner exists in the product the TrackerFactory can be used as a temporary object to create the ITracker, i.e.:
import { Owner, TrackerFactory, ITracker } from "@episerver/telemetry";
const tracker: ITracker = (new TrackerFactory({
config: {
instrumentationKey: "[Application Insights key]"
},
authenticatedUserId: "[Hashed (SHA512) derived from the user email without salt. If the user email is not available, the username can be used instead.]",
accountId: "[Hashed (SHA512) derived from a unique customer account identifier without salt. The license key should be used if it's available.]",
customProperties: {
// Any additional data that should be sent on each event.
}
})).getTracker("['Owner' enum value or short lowercase alias for who owns the data]);
Then use that tracker object to send analytics where and when needed. Do not track more than you need to analyze a feature's worth to the user.
ITracker has two main methods:
trackPageView: Send a page view tracking event. If the product uses Platform Navigation this method is not needed.trackEvent: Send a custom tracking event.Read more about event naming under "Event naming convention" before publishing any events.
Example from CMS UI task creation trackers:
tracker.trackEvent("edit_contentCreated", {
contentType: isPage ? "page" : "block",
entryPoint: entry.entryPoint,
isLocalAsset: this.createAsLocalAsset
});
In order to keep the events tidy and clean across all our products we want to adhere to a naming convention.
Owner => Context(optional) => Action
Owner enum or if your team is not listed use an appropriate lowercase acronym similar to the enum.All events are formatted like this with words camelCased.
ownerName_actionName
ownerName_contextName_actionName
Some examples:
Words are camelCased. Underline (_) is used as separator. Context is optional.
propertyName
contextName_propertyName
cms_sign_in
cms_sign_out
Its good to be consistent.
cms_Sign_IN
cms_Sign_out
The name should follow the naming convention and be consistent.
The context is mainly good for sorting and grouping similar events to each other but that have distinct actions.
cms_project_create
cms_project_delete
We have the context of project but with two distinct actions.
cms_edit_createProject
cms_edit_time
cms_edit_buttonClick
The shared context "edit" is too broad to be applied to all three events and some actions contain their own context.
Always consider what you want to compare and what the question is that you want to answer.
cms_publish
commandType => "smart" | "inline" | "default"
Comparing "commandType" from the same action "publish" makes sense.
cms_edit_time
editMode => "formedit" | "onpageedit"
cms_edit_contentSaved
editMode => "formedit" | "onpageedit"
Comparing "editMode" with identical values from two different edit events makes sense.
cms_create_page
type => "My Special Page"
Adding user input into a property is totally fine.
cms_edit
commandType => "time" | "contentSaved"
editMode => "formedit" | "onpageedit"
The "commandType" values "time" (minutes) and "contentSaved" (nr of edits) doesn't make sense to compare.
cms_page_createSpecialFoobar
The action "createSpecialFoobar" is too specific and the page type should be a property instead.
Apache 2.0 © Episerver
FAQs
Telemetry library for Episerver products
We found that @episerver/telemetry demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.