
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
@mparticle/web-braze-kit
Advanced tools

⚠️⚠️⚠️
You can now select what version of the Braze SDK you want to use when setting up a Braze connection in the mParticle UI. Braze occasionally makes breaking changes to their SDK, so if you call appboy directly in your code, you will have to update your code to ensure your website performs as expected when updating versions of Braze.
Please review the Braze Changelog and V4 migration guide to learn about the differences between V3 and V4 and what changes you will need to make in your code. The most significant breaking changes are the replacement of the appboy class name with braze, in addition to the removal and renaming of several APIs.
You can opt into the latest major version of the Braze Web SDK whether you implement mParticle's Web SDK using npm or our snippet/CDN.
Version 4 under Braze Web SDK Version in the Braze connection settings.Version 4 under Braze Web SDK Version in the Braze connection settings.Note that the following is only one example. Everywhere you manually call appboy needs to be updated similar to the below. If you are using NPM, you can skip to step 3. Please be sure to test your site fully in development prior to releasing.
appboy.display namespace. Braze has removed all instances of the display namespace:window.appboy.display.destroyFeed();
Step 2: Roll out code changes prior to opting in to V4
if (window.appboy) {
window.appboy.display.destroyFeed();
} else if (window.braze) {
window.braze.destroyFeed();
}
Step 3: Whether you are using the snippet or self hosting, you need to navigate to your Braze connection settings and select Version 4 from the Braze Web SDK Version drop down.
Step 4: After you opt in, you can simplify your code. We recommend testing and waiting at least 24 hours between opting in and removing previous instances of appboy and doing thorough testing of your application in a development environment to ensure everything is working:
window.braze.destroyFeed();
Step 5: Push Notifications via service-worker.js
If you use Push Notifications, we have updated the service-worker.js file. In our testing, Braze’s push notifications work as expected regardless of what version of the service-worker is used, but we recommend updating this file to ensure future compatibility. In your service-worker.js file, update the code to reference https://static.mparticle.com/sdk/js/braze/service-worker-4.2.0.js instead of https://static.mparticle.com/sdk/js/braze/service-worker-3.5.0.js. Your service-worker.js file should now contain:
self.imports('https://static.mparticle.com/sdk/js/braze/service-worker-4.2.0.js')
The legacy @mparticle/web-appboy-kit from npm includes version 2 of the Braze Web SDK. As part of this update, we've created a new Braze web kit repo to replace our deprecated Appboy web kit repo. If you are still using @mparticle/web-appboy-kit, you will need to consider the breaking changes Braze made between V2 and V3 of the Braze SDK (found here) as well as the instructions above to get from V2 to V4 of the Braze SDK.
Copyright 2022 mParticle, Inc.
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
FAQs
mParticle integration sdk for Braze
The npm package @mparticle/web-braze-kit receives a total of 2,171 weekly downloads. As such, @mparticle/web-braze-kit popularity was classified as popular.
We found that @mparticle/web-braze-kit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 9 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.