Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@segment/analytics.js-core
Advanced tools
The hassle-free way to integrate analytics into any web application.
This is the core of Analytics.js, the open-source library that powers data collection at Segment.
To build this into a full, usable library, see the Analytics.js repository.
We recently introduced Typescript support and types to Analytics.js Core. While the exposed types still need some work (pull requests are welcome!), they're ready to be used.
If you use analytics.js-core as an npm module, you can use its types out of the box:
If you create a source at https://app.segment.com, Segement automatically generates a JS snippet that you can add to your website. (for more information visit our documentation).
To use types with the snippet, add analytics
as part of the global module.
Something like this:
import { SegmentAnalytics } from '@segment/analytics.js-core';
declare global {
interface Window {
analytics: SegmentAnalytics.AnalyticsJS;
}
}
npm
packageWe recommend using the CDN version of analytics.js
as it offers all the project and workspace specific settings, enabled integrations, and middleware. But if you prefer to use analytics.js-core
as a standalone npm package using your own tooling & workflow, you can do the following:
1- Install the dependencies
yarn add @segment/analytics.js-core
yarn add @segment/analytics.js-integration-segmentio
// you may need this depending on the bundler
yarn add uuid@^3.4
2- Import the dependencies
import Analytics from "@segment/analytics.js-core/build/analytics";
import SegmentIntegration from "@segment/analytics.js-integration-segmentio";
3- Initialize Segment and add Segment's own integration
// instantiate the library
const analytics = new Analytics();
// add Segment's own integration ( or any other device mode integration )
analytics.use(SegmentIntegration);
// define the integration settings object.
// Since we are using only Segment integration in this example, we only have
// "Segment.io" in the integrationSettings object
const integrationSettings = {
"Segment.io": {
apiKey: "<YOUR SEGMENT WRITE KEY>",
retryQueue: true,
addBundledMetadata: true
}
};
// Initialize the library
analytics.initialize(integrationSettings);
// Happy tracking!
analytics.track('🚀');
Released under the MIT license.
FAQs
The hassle-free way to integrate analytics into any web application.
We found that @segment/analytics.js-core demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 135 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.