
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@mozmeao/trafficcop
Advanced tools
(If you want to skip the spiel and get straight to business, check out the docs.)
Install via npm: npm install @mozmeao/trafficcop
Import the library at your applications entrypoint via require, import or by using a global variable in your script tag:
import TrafficCop from '@mozmeao/trafficcop';
const TrafficCop = require('@mozmeao/trafficcop');
const TrafficCop = window.TrafficCop;
Traffic Cop is a small bit of JavaScript that decides if a visitor should see a variation of the current page. If so, one of two things happens:
www.example.com/product
www.example.com/product?v=2
or
b. a developer-specified JavaScript function is passed the value of 2
and executedWhat happens on www.example.com/product?v=2
, or in the JavaScript function, is completely up to the developer (possibly you, dear reader).
Most of the content experiments on mozilla.org simply direct (or police, if you will) targeted visitors into pre-set variation cohorts. We weren't aware of any developer-focused (simple, light, flexible) solutions, so we wrote one.
In contrast to third-party options (e.g. Optimizely), Traffic Cop offers:
A visitor hits a URL running an experiment (meaning the appropriate JS is loaded). Traffic Cop picks a random number, and, if that random number falls within the range specified by a variation (see below), either redirects the visitor to that variation or executes an arbitrary, developer-specified callback function.
For redirects, Traffic Cop assumes all variations are loaded through a query string parameter appended to the original URL. This keeps things simple, as no new URL patterns need to be defined (and later removed) for each experiment. First, check for the query string parameter (wherever your application might do that sort of thing) and then load different content accordingly.
The configuration file has two steps. Instantiate a new Traffic Cop with your experiment configuration, and then initialize it.
// example configuration for a redirect experiment
var wiggum = new TrafficCop({
variations: {
‘v=1’: 10.5,
‘v=2’: 0.25
}
});
wiggum.init();
In the above example, a visitor would have a 10.5% chance of being chosen for v=1
, and a 0.25% chance for v=2
. If the visitor is selected for a variation, the user will be redirected to the current URL with either ?v=1
or ?v=2
appended.
Note that Traffic Cop supports percentages into the hundredths, but no smaller.
// example configuration for a callback function experiment
function myCallback(variation) {
console.log('The chosen variation was ' + variation);
// and then change button color based on variation chosen...
}
var lou = new TrafficCop({
customCallback: myCallback,
variations: {
‘a’: 25,
‘b’: 25,
'c': 25
}
});
lou.init();
//
In the above example, a visitor would have a 25% chance of being chosen for a
, b
, or c
. The chosen variation will be passed to the myCallback
function (which can do whatever it likes).
Check out the docs for more complete information.
This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0.
FAQs
A/B testing framework from the fine folks working on mozilla.org
The npm package @mozmeao/trafficcop receives a total of 276 weekly downloads. As such, @mozmeao/trafficcop popularity was classified as not popular.
We found that @mozmeao/trafficcop demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.