Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
@opendoor/optimizely-sdk
Advanced tools
Optimizely X Full Stack is A/B testing and feature management for product development teams. Experiment in any application. Make every feature on your roadmap an opportunity to learn. Learn more at the landing page, or see the documentation.
This directory contains the source code for the JavaScript SDK, which is usable in Node.js, browsers, and beyond.
Ensure the SDK supports all of the platforms you're targeting. In particular, the SDK targets any ES5-compliant JavaScript environment. We officially support:
npm test
to validate for yourself), but are not formally supported.Other environments likely are compatible, too, but note that we don't officially support them:
Once you've validated that the SDK supports the platforms you're targeting, fetch the package from NPM. Using npm
:
npm install --save @opendoor/optimizely-sdk
See the Optimizely X Full Stack developer documentation to learn how to set up your first JavaScript project and use the SDK.
The package's entry point is a CommonJS module, which can be used directly in environments which support it (e.g., Node.js, or loaded in a browser via Browserify or RequireJS). Additionally, you can include a standalone bundle of the SDK in your web page by fetching it from unpkg:
<script src="https://unpkg.com/@opendoor/optimizely-sdk/dist/optimizely.browser.umd.min.js"></script>
<!-- You can also use the unminified version if necessary -->
<script src="https://unpkg.com/@opendoor/optimizely-sdk/dist/optimizely.browser.umd.js"></script>
When evaluated, that bundle assigns the SDK's exports to window.optimizelySdk
. If you wish to use the asset locally (for example, if unpkg is down), you can find it in your local copy of the package at dist/optimizely.browser.umd.min.js.
Regarding EventDispatcher
s: In Node.js and browser environments, the default EventDispatcher
is powered by the http/s
modules and by XMLHttpRequest
, respectively. In all other environments, you must supply your own EventDispatcher
.
This version represents a major version change and, as such, introduces some breaking changes:
The Node.js SDK is now combined with the JavaScript SDK. We now have just one package, @opendoor/optimizely-sdk
, that works in many JavaScript environments.
We no longer support Node.js < 4.0.0, which collectively reached end-of-life on 2016-12-31.
You will no longer be able to pass in revenue
value as a stand-alone argument to the track
call. Instead you will need to pass it as an entry in the eventTags
.
To access Feature Management in the Optimizely web application, please contact your Optimizely account executive.
This information is relevant only if you plan on contributing to the SDK itself.
# Prerequisite: Install dependencies.
npm install
# Run unit tests with mocha.
npm test
# Run unit tests in many browsers, currently via BrowserStack.
# For this to work, the following environment variables must be set:
# - BROWSER_STACK_USERNAME
# - BROWSER_STACK_PASSWORD
npm run test-xbrowser
.travis.yml contains the definitions for BROWSER_STACK_USERNAME
and BROWSER_STACK_ACCESS_KEY
used in CI. These values are Optimizely's BrowserStack credentials, encrypted with our Travis CI public key. These creds can be rotated by following these docs.
First-party code (under lib/) is copyright Optimizely, Inc. and contributors, licensed under Apache 2.0.
Prod dependencies are as follows:
{
"json-schema@0.2.3": {
"licenses": [
"AFLv2.1",
"BSD"
],
"publisher": "Kris Zyp",
"repository": "https://github.com/kriszyp/json-schema"
},
"lodash@4.17.10": {
"licenses": "MIT",
"publisher": "John-David Dalton",
"repository": "https://github.com/lodash/lodash"
},
"murmurhash@0.0.2": {
"licenses": "MIT*",
"repository": "https://github.com/perezd/node-murmurhash"
},
"sprintf@0.1.5": {
"licenses": "BSD-3-Clause",
"publisher": "Moritz Peters",
"repository": "https://github.com/maritz/node-sprintf"
},
"uuid@3.2.1": {
"licenses": "MIT",
"repository": "https://github.com/kelektiv/node-uuid"
}
}
To regenerate this, run the following command:
npx license-checker --production --json | jq 'map_values({ licenses, publisher, repository }) | del(.[][] | nulls)'
and remove the self (@opendoor/optimizely-sdk
) entry.
FAQs
JavaScript SDK for Optimizely X Full Stack
We found that @opendoor/optimizely-sdk demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 73 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.