
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@likecoin/nuxt-google-optimize
Advanced tools
SSR friendly Google Optimize module for Nuxt.js
nuxt-google-optimize dependency using yarn or npm to your projectyarn add nuxt-google-optimize
OR
npm install nuxt-google-optimize --save
nuxt-google-optimize to modules section of nuxt.config.js{
modules: [
'nuxt-google-optimize',
],
// Optional options
googleOptimize: {
// experimentsDir: '~/experiments',
// maxAge: 60 * 60 * 24 * 7 // 1 Week
// pushPlugin: true,
// externalExperimentsSrc: 'https://my.experi.ment/list',
// cookieDomain: '.experi.ment', // must valid domain/subdomain
// useFetch: true, // use fetch() if possible for preload to work properly
}
}
Create experiments directory inside your project.
Create experiments/index.js to define all available experiments:
import backgroundColor from './background-color'
export default [
backgroundColor
]
Each experiment should export an object to define itself.
experiments/background-color/index.js:
export default {
// A helper exp-{name}-{var} class will be added to the root element
name: 'background-color',
// Google optimize experiment id
experimentID: '....',
// [optional] specify number of sections for MVT experiments
// sections: 1,
// [optional] maxAge for a user to test this experiment
// maxAge: 60 * 60 * 24, // 24 hours,
// [optional] Enable/Set experiment on certain conditions
// isEligible: ({ route }) => route.path !== '/foo'
// Implemented variants and their weights
variants: [
{ weight: 0 }, // <-- This is the default variant
{ weight: 2 },
{ weight: 1 }
],
}
$expGlobal object $exp will be universally injected in the app context to determine the currently active experiment.
It has the following keys:
{
// Index of currently active experiment
"$experimentIndex": 0,
// Indext of currently active experiment variants
"$variantIndexes": [
1
],
// Same as $variantIndexes but each item is the real variant object
"$activeVariants": [
{
/* */
}
],
// Classes to be globally injected (see global style tests section)
"$classes": [
"exp-background-color-1" // exp-{experiment-name}-{variant-id}
],
// All of the keys of currently active experiment are available
"name": "background-color",
"experimentID": "testid",
"sections": 1,
"maxAge": 60,
"variants": [
/* all variants */
]
}
Using inside components:
<script>
export default {
methods: {
foo() {
// You can use this.$exp here
}
}
}
</script>
Using inside templates:
<div v-if="$exp.name === 'something'">
<!-- You can optionally use $exp.$activeVariants and $exp.$variantIndexes here -- >
...
</div>
<div v-else>
...
</div>
Inject global styles to page body.
layouts/default.vue:
<template>
<nuxt/>
</template>
<script>
export default {
head () {
return {
bodyAttrs: {
class: this.$exp.$classes.join(' ')
}
}
},
}
</script>
If you have custom CSS for each test, you can import it inside your experiment's .js file.
experiments/background-color/index.js:
import './styles.scss'
With Sass:
.exp-background-color {
// ---------------- Variant 1 ----------------
&-1 {
background-color: red;
}
// ---------------- Variant 2 ----------------
&-2 {
background-color: blue;
}
}
With CSS:
/* Variant 1 */
.exp-background-color-1 {
background-color: red;
}
/* Variant 2 */
.exp-background-color-2 {
background-color: blue;
}
yarn install or npm installyarn run dev or npm run devhttp://localhost:3000MIT License - Alibaba Travels Co
FAQs
SSR friendly Google Optimize module for Nuxt.js
We found that @likecoin/nuxt-google-optimize demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.