
Security News
/Research
Popular node-ipc npm Package Infected with Credential Stealer
Socket detected malicious node-ipc versions with obfuscated stealer/backdoor behavior in a developing npm supply chain attack.
@hifilabs/pixel
Advanced tools
artistPixel - Lightweight browser tracking script for artist fan analytics
A lightweight, consent-aware analytics pixel for artist fan tracking with platform pixel orchestration (Meta, TikTok, Google Ads).
npm install @hifilabs/pixel
# or
pnpm add @hifilabs/pixel
Zero-config setup that reads from environment variables:
// app/layout.tsx
import { ArtistOS } from '@hifilabs/pixel';
export default function RootLayout({ children }) {
return (
<html>
<body>
<ArtistOS />
{children}
</body>
</html>
);
}
Set environment variables:
NEXT_PUBLIC_ARTIST_ID=your-artist-id
NEXT_PUBLIC_META_PIXEL_ID=123456789 # Optional
NEXT_PUBLIC_TIKTOK_PIXEL_ID=ABC123DEF # Optional
NEXT_PUBLIC_GOOGLE_ADS_ID=AW-123456789 # Optional
import { ArtistOS } from '@hifilabs/pixel';
<ArtistOS
artistId="your-artist-id"
metaPixelId="123456789"
tiktokPixelId="ABC123DEF"
googleAdsId="AW-123456789"
debug={process.env.NODE_ENV === 'development'}
/>
Using Pixel CDN (Recommended) - Config auto-loaded from artistHQ:
<script
src="https://pixel-cdn.hifilabs.workers.dev/your-artist-id.js"
data-project-id="your-project-id"
data-debug="true"
></script>
The CDN version automatically includes your pixel configuration (Meta, TikTok, Google Ads IDs) from artistHQ β Settings β Integrations. Changes are reflected without redeploying.
Manual Configuration - Explicit pixel IDs in script:
<script
src="https://e.os.xyz/pixel.js"
data-artist-id="your-artist-id"
data-meta-pixel-id="123456789"
data-tiktok-pixel-id="ABC123DEF"
data-google-ads-id="AW-123456789"
data-debug="true"
></script>
artistPixel orchestrates third-party platform pixels with consent awareness:
| Platform | Environment Variable | Prop |
|---|---|---|
| Meta/Facebook | NEXT_PUBLIC_META_PIXEL_ID | metaPixelId |
| TikTok | NEXT_PUBLIC_TIKTOK_PIXEL_ID | tiktokPixelId |
| Google Ads | NEXT_PUBLIC_GOOGLE_ADS_ID | googleAdsId |
Control which events are forwarded to platform pixels:
<ArtistOS
artistId="your-artist-id"
metaPixelId="123456789"
forwardEvents={{
pageview: true, // Forward page views (default: true)
purchase: true, // Forward purchases (default: true)
addToCart: true, // Forward add to cart (default: true)
lead: true, // Forward leads (default: true)
custom: ['newsletter_signup', 'merch_view'] // Custom events to forward
}}
/>
import { useArtistOS } from '@hifilabs/pixel';
function MyComponent() {
const { track, page, purchase, identify } = useArtistOS();
// Track custom event
track('newsletter_signup', { source: 'footer' });
// Track page view
page({ title: 'Product Page' });
// Track purchase
purchase(99.99, 'USD', { product: 'Album', sku: 'ALB-001' });
// Identify user
await identify('fan@email.com', { name: 'Fan Name' });
}
import { track, page, purchase, identify } from '@hifilabs/pixel';
// Works in client components, safe to import in server components
track('event_name', { property: 'value' });
page({ title: 'Page Title' });
purchase(29.99, 'USD', { item: 'Merch' });
await identify('email@example.com');
<ArtistOS
artistId="your-artist-id"
consentMode="built-in" // Shows built-in consent banner
/>
import { useArtistOS } from '@hifilabs/pixel';
function CustomConsentBanner() {
const { setConsent, getConsent } = useArtistOS();
const handleAcceptAll = () => {
setConsent({
analytics: true,
marketing: true,
personalization: true,
timestamp: new Date().toISOString()
});
};
const handleRejectMarketing = () => {
setConsent({
analytics: true,
marketing: false,
personalization: false,
timestamp: new Date().toISOString()
});
};
return (
<div>
<button onClick={handleAcceptAll}>Accept All</button>
<button onClick={handleRejectMarketing}>Essential Only</button>
</div>
);
}
1. Default: denied
2. Show banner
3. User chooses
4. Update consent
5. Track (if analytics granted)
6. Platform pixels injected (if marketing consent granted)
Import the custom template from gtm/artistPixel.tpl:
See gtm/README.md for detailed instructions.
import {
useArtistPixelEcommerce, // Products, cart, checkout
useArtistPixelMedia, // Audio/video tracking
useArtistPixelEngagement, // Shares, likes, scroll depth
useArtistPixelForm, // Form interactions
useArtistPixelSearch, // Search & discovery
useArtistPixelNotification,// Push, email, in-app
useArtistPixelSocial, // Social & community
useArtistPixelAuth, // Authentication flows
useArtistPixelError, // Error monitoring
useArtistPixelAB, // A/B testing
useArtistPixelLive, // Livestream events
useArtistPixelSubscription,// Subscriptions & payments
} from '@hifilabs/pixel';
| Prop | Type | Default | Description |
|---|---|---|---|
artistId | string | env var | Artist identifier |
metaPixelId | string | env var | Meta/Facebook Pixel ID |
tiktokPixelId | string | env var | TikTok Pixel ID |
googleAdsId | string | env var | Google Ads ID (AW-xxx) |
consentMode | 'built-in' | 'c15t' | 'custom' | 'custom' | Consent management mode |
forwardEvents | ForwardingConfig | all true | Event forwarding config |
debug | boolean | false | Enable debug logging |
exclude | string[] | [] | URL patterns to exclude |
trackFileDownloads | boolean | false | Auto-track file downloads |
hashRouting | boolean | false | Track hash route changes |
| Attribute | Description |
|---|---|
data-artist-id | Artist identifier (required) |
data-project-id | Project identifier |
data-meta-pixel-id | Meta/Facebook Pixel ID |
data-tiktok-pixel-id | TikTok Pixel ID |
data-google-ads-id | Google Ads ID |
data-forward-pageview | Forward pageviews (true/false) |
data-forward-purchase | Forward purchases (true/false) |
data-forward-custom | Custom events (comma-separated) |
data-exclude-pages | URL patterns to exclude (comma-separated) |
data-debug | Enable debug mode |
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β artistPixel β
β βββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β First-Party Collection β β
β β (Always runs, stores in Firestore) β β
β βββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
β β β
β consent check β
β β β
β βββββββββββββββββββββββββββΌββββββββββββββββββββββββββββββ β
β β Platform Pixel Orchestrator β β
β β (Only when marketing consent granted) β β
β β ββββββββββββ ββββββββββββ ββββββββββββ β β
β β β Meta β β TikTok β β Google β β β
β β β Pixel β β Pixel β β Ads β β β
β β ββββββββββββ ββββββββββββ ββββββββββββ β β
β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
MIT
FAQs
artistPixel - Lightweight browser tracking script for artist fan analytics
We found that @hifilabs/pixel demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.Β It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
Socket detected malicious node-ipc versions with obfuscated stealer/backdoor behavior in a developing npm supply chain attack.

Security News
TeamPCP and BreachForums are promoting a Shai-Hulud supply chain attack contest with a $1,000 prize for the biggest package compromise.

Security News
Packagist urges PHP projects to update Composer after a GitHub token format change exposed some GitHub Actions tokens in CI logs.