
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@readyplayerme/icp-analytics
Advanced tools
A TypeScript analytics package designed for Next.js server-side environments to track user interactions and page loads for Ready Player Me ICP applications.
A TypeScript analytics package designed for Next.js server-side environments to track user interactions and page loads for Ready Player Me ICP (Interactive Character Platform) applications.
This package requires a Next.js project (version 13 or higher) with server-side capabilities.
Set these environment variables in your Next.js project:
EVENTS_WEBHOOK_URL=https://us-webhook.hevodata.com/t/your-webhook-id
EVENTS_ACCESS_KEY=your-access-key
EVENTS_SECRET_KEY=your-secret-key
npm install @readyplayerme/icp-analytics
import { NextRequest, NextResponse } from 'next/server';
import {
trackIcpLoaded,
trackIcpInteracted,
createTrackingContext
} from '@readyplayerme/icp-analytics';
// In an API route
export async function GET(request: NextRequest) {
const context = createTrackingContext(request, 'my_game_project');
// Track page load
const { sessionCookie } = await trackIcpLoaded(context, 'homepage');
const response = NextResponse.json({ success: true });
// Set session cookie
response.cookies.set('icp_session', sessionCookie, {
httpOnly: true,
secure: process.env.NODE_ENV === 'production',
sameSite: 'lax',
maxAge: 30 * 60 * 1000 // 30 minutes
});
return response;
}
// Track user interaction
export async function POST(request: NextRequest) {
const context = createTrackingContext(request);
const { sessionCookie } = await trackIcpInteracted(
context,
'start_game_button',
'Chess Game Card',
'games_page'
);
const response = NextResponse.json({ success: true });
response.cookies.set('icp_session', sessionCookie, {
httpOnly: true,
secure: process.env.NODE_ENV === 'production',
sameSite: 'lax',
maxAge: 30 * 60 * 1000
});
return response;
}
import { NextRequest, NextResponse } from 'next/server';
import { trackIcpLoaded, createTrackingContext } from '@readyplayerme/icp-analytics';
export async function middleware(request: NextRequest) {
// Track page loads automatically
if (request.nextUrl.pathname.startsWith('/games')) {
const context = createTrackingContext(request);
const { sessionCookie } = await trackIcpLoaded(context, 'games_page');
const response = NextResponse.next();
response.cookies.set('icp_session', sessionCookie, {
httpOnly: true,
secure: process.env.NODE_ENV === 'production',
sameSite: 'lax',
maxAge: 30 * 60 * 1000
});
return response;
}
}
createTrackingContext(request: NextRequest, projectName?: string)Creates a tracking context for server-side analytics.
Parameters:
request (required): Next.js request objectprojectName (optional): Custom project name, defaults to hostname-based nameReturns: TrackingContext object
trackIcpLoaded(context: TrackingContext, screenCategory: string, screenName?: string)Tracks page or screen load events server-side.
Parameters:
context (required): Tracking context from createTrackingContext()screenCategory (required): Readable name of the page (e.g., 'homepage', 'games_page')screenName (optional): Custom screen name, defaults to request pathnameReturns: Promise resolving to { sessionCookie: string }
trackIcpInteracted(context: TrackingContext, elementName: string, subelementId: string, screenCategory: string, screenName?: string)Tracks user interaction events server-side.
Parameters:
context (required): Tracking context from createTrackingContext()elementName (required): Name of the interactive element (e.g., 'start_game_button')subelementId (required): Detailed information about what was clicked (e.g., 'Chess Game Card')screenCategory (required): Readable name of the page where interaction occurredscreenName (optional): Custom screen name, defaults to request pathnameReturns: Promise resolving to { sessionCookie: string }
getClientIP(request: NextRequest)Utility function to extract client IP from request headers.
Parameters:
request (required): Next.js request objectReturns: Client IP address string
enhanceSessionWithCountry(sessionData: SessionData, clientIP: string)Enhances session data with country information from IP lookup.
Parameters:
sessionData (required): Session data objectclientIP (required): Client IP addressReturns: Promise resolving to enhanced SessionData
Both functions send events with the following structure:
{
event: 'icp_interacted',
properties: {
user_session_id: 'unique-session-id',
user_pseudo_id: 'unique-user-id',
product_name: 'project-name',
screen_name: '/path/or/custom-name',
screen_category: 'readable-page-name',
interaction: 'loaded' | 'tap',
element_name: 'element-name' | null,
subelement_id: 'subelement-details' | null,
flow_number: 1,
country: 'US',
device_type: 'desktop' | 'mobile' | 'tablet' | 'unknown',
traffic_source: 'direct' | 'utm-source' | 'referrer-domain'
}
}
The package automatically collects:
The package uses HTTP-only cookies for session persistence:
// Recommended cookie settings
response.cookies.set('icp_session', sessionCookie, {
httpOnly: true, // Security
secure: process.env.NODE_ENV === 'production', // HTTPS only in production
sameSite: 'lax', // CSRF protection
maxAge: 30 * 60 * 1000 // 30 minutes
});
The package includes robust error handling:
npm run build
TypeScript definitions are included. The package exports proper types for all functions.
MIT
For issues related to this package, please contact the Ready Player Me development team.
FAQs
A TypeScript analytics package designed for Next.js server-side environments to track user interactions and page loads for Ready Player Me ICP applications.
We found that @readyplayerme/icp-analytics demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 21 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.