Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
@financial-times/ads-embed
Advanced tools
Facilitate communication between advertising creatives in iframes and the main o-ads library via post message
This module facilitates communication between advertising creatives in iframes and the @financial-times/ads-legacy-o-ads
library via post message.
It requires an instance of ads-legacy-o-ads
's module to be existing in the top window to listen for the message.
This module is designed to be included in advertising creatives and not installed as a dependency.
On touch screen devices touch events are captured by iframes and not passed on to the parent page, this can be an issue under some circumstances such as an ad included in a gallery where swiping is required to move forwards.
To mitigate these circumstances ads-embed
will detect when a touch screen is present and post the touchstart
, touchend
and touchmove
events to ads-legacy-o-ads
via post message. You can listen for oAds.touch
events in the top window if you need to react to these events.
In a creative wrapper, include the following:
<script src="https://www.ft.com/__origami/service/build/v3/bundles/js?components=o-ads-embed@^3.0.0&system_code=advertising"></script>
if (window !== window.top) {
window.Origami['o-ads-embed'].init();
}
In a creative in DFP, include the following:
<div data-o-ads-collapse></div>
<script src="https://www.ft.com/__origami/service/build/v3/bundles/js?components=o-ads-embed@^3.0.0&system_code=advertising"></script>
if (window !== window.top) {
window.Origami['o-ads-embed'].init();
}
This will collapse any ad slot that serves the creative with this code inside it.
Since v4 ads-embed
will send a postMessage to the top
browsing context (usually the main window in a production setup) whenever an html element is found in its browsing context (i.e. the creative wrapper) that contains a data-o-ads-class
attribute.
The postMessage will contain an object containing type: "oAds.slotClass"
. Additionally it will contain a property slotClass
with the value of the data-o-ads-class
attribute.
Example:
If the creative wrapper contains an element like this <div data-o-ads-class="sticky"></div>
, a postMessage will be sent with a payload object like this:
{
type: "oAds.slotClass",
slotClass: "sticky"
}
There are two demos that demonstrate the two uses mentioned above. In order to get things running, you'll need to add the following lines at the bottom of main.js
and run obt build
.
window.Origami = {
'o-ads-embed': oAdsEmbed
}
The reason for this is that in a creative wrapper, we would load o-ads-embed through the Origami registry, which places a global Origmai
object on the page with all of the modules requested. When we run the demos, we simply include a built version of the module from /build/main.js
.
Run the demo with obt demo --runServer
.
Run the o-ads demos alongside (npm run demo-server
), then visit http://localhost:3002/demos/local/o-ads-embed.html. You should see both the o-ads-embed demos load up in iframes on this page.
FAQs
Facilitate communication between advertising creatives in iframes and the main o-ads library via post message
The npm package @financial-times/ads-embed receives a total of 17 weekly downloads. As such, @financial-times/ads-embed popularity was classified as not popular.
We found that @financial-times/ads-embed demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.