
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
@guardian/commercial-bundle
Advanced tools
The bundle that provides the advertising logic for the https://theguardian.com
This package contains the code for the commercial bundle that is loaded on all pages on theguardian.com.
To install the package, run yarn add @guardian/commercial-bundle.
To install dependencies, run yarn.
To develop locally, run yarn serve to start a local server. This will watch for changes and rebuild the bundle. Serving it at http://localhost:3031.
To run the unit tests, run yarn test.
To run the integration tests, switch to the e2e workspace to run yarn cypress:open or yarn cypress:run to run cypress integration tests.
Changes are automatically released to NPM.
The main branch on GitHub is analysed by semantic-release after every push.
If a commit message follows the conventional commit format, semantic-release can determine what types of changes are included in that commit.
If necessary, it will then automatically release a new, semver-compliant version of the package to NPM.
You can then bump the version of the package in Frontend, to use the new version.
Try to write PR titles in the conventional commit format, and squash and merge when merging. That way your PR will trigger a release when you merge it (if necessary).
To use the bundle locally with DCR, run COMMERCIAL_BUNDLE_URL=http://localhost:3031/graun.standalone.commercial.js PORT=3030 make dev in the DCR directory.
DCR will then use the local bundle instead of the one from PROD/CODE.
To use the bundle locally with Frontend, you can override your default Frontend configuration (see the Frontend docs for more detail on this) to point to a local commercial dev server. For example, save the following in ~/.gu/frontend.conf:
devOverrides {
commercial.overrideCommercialBundleUrl="http://localhost:3031/graun.standalone.commercial.js"
}
Frontend will then use the local bundle instead of the one from PROD/CODE. Frontend will pass the local bundle URL along to DCR, so you don't have to override there if you've done it in Frontend.
To use the production bundle locally with Frontend, run yarn link in the bundle directory. Then run yarn link @guardian/commercial-bundle in the frontend directory. Finally, start the frontend server as usual.
Frontend will then use the local bundle instead of the one from PROD/CODE.
To test the bundle on CODE, create a PR, add the [beta] @guardian/commercial-bundle label, this will release a beta version of the bundle to NPM, the exact version will be commented on your PR.
On a branch on frontend you can update the version of the bundle to the beta version and deploy to CODE to test.
FAQs
The bundle that provides the advertising logic for the https://theguardian.com
The npm package @guardian/commercial-bundle receives a total of 75 weekly downloads. As such, @guardian/commercial-bundle popularity was classified as not popular.
We found that @guardian/commercial-bundle demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 47 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.