Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@oddcamp/pdx-dol
Advanced tools
yarn install
yarn develop
yarn serve
Install yarn install @oddcamp/pdx-dol
and
import PdxDol from "@oddcamp/pdx-dol"
const pdxdol = new PdxDol()
pdxdol.start()
By default it tracks these parameters:
utm_source
utm_medium
utm_campaign
utm_term
utm_content
PdxDol
function accepts an object of the following global options (some of
them have the default values set):
excludeSelector: `.js--pdxdol-exclude`
includeSelector: ``
params: {}
PdxDol
intercepts link clicks and adds the configured parameters to URL of
an outbound link.
You can set the global parameters that are appended to all outbound links, e.g.:
PdxDol({
params: {
utmSource: `source`,
utmMedium: `medium`,
utmCampaign: `campaign`,
utmTerm: `term`,
utmContent: `content`,
},
})
However, the parameters set via PdxDol
may be overriden by window.location
parameters that are stored in sessionStorage
and used throughout the session.
You can alter a global parameter for a specific link by using data-*
attribute(s) e.g.:
<a href="https://www.google.com" data-utm-medium="another-medium">Link</a>
The user is then redirected to:
https://www.google.com?utm_source=source&utm_medium=another-medium
You can exclude an outbound link or multiple links from being intercepted
by using excludeSelector
attribute. Let's use the default one, e.g.:
<a href="https://www.google.com" class="js--pdxdol-exclude">Excluded</a>
<p class="js--pdxdol-exclude">
<a href="https://www.google.com">Excluded</a>
<a href="https://www.google.com">Excluded</a>
</p>
Or you can change the utility behaviour from include-all to exclude all by
by using includeSelector
that only tracks the matching link clicks.
If both are set includeSelector
supersedes excludeSelector
.
As mentioned above, the utility tracks UTM parameters by default. But you can also append a custom trackable parameters, e.g.:
PdxDol({
params: {
customParam1: ``,
customParam2: `has-a-value`,
},
})
start()
pause()
resume()
isPaused()
The utility depends on URL Web API. If you need this to be supported on IE then url-polyfill will help you out in most of the cases.
FAQs
## Local development
The npm package @oddcamp/pdx-dol receives a total of 1 weekly downloads. As such, @oddcamp/pdx-dol popularity was classified as not popular.
We found that @oddcamp/pdx-dol demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.