Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
@segment/analytics.js-core
Advanced tools
The hassle-free way to integrate analytics into any web application.
This is the core of Analytics.js, the open-source library that powers data collection at Segment.
To build this into a full, usable library, see the Analytics.js repository.
We recently introduced Typescript support and types to Analytics.js Core. While the exposed types still need some work (pull requests are welcome!), they're ready to be used.
If you use analytics.js-core as an npm module, you can use its types out of the box:
If you create a source at https://app.segment.com, Segement automatically generates a JS snippet that you can add to your website. (for more information visit our documentation).
To use types with the snippet, add analytics
as part of the global module.
Something like this:
import { SegmentAnalytics } from '@segment/analytics.js-core';
declare global {
interface Window {
analytics: SegmentAnalytics.AnalyticsJS;
}
}
npm
packageWe recommend using the CDN version of analytics.js
as it offers all the project and workspace specific settings, enabled integrations, and middleware. But if you prefer to use analytics.js-core
as a standalone npm package using your own tooling & workflow, you can do the following:
1- Install the dependencies
yarn add @segment/analytics.js-core
yarn add @segment/analytics.js-integration-segmentio
// you may need this depending on the bundler
yarn add uuid@^3.4
2- Import the dependencies
import Analytics from "@segment/analytics.js-core/build/analytics";
import SegmentIntegration from "@segment/analytics.js-integration-segmentio";
3- Initialize Segment and add Segment's own integration
// instantiate the library
const analytics = new Analytics();
// add Segment's own integration ( or any other device mode integration )
analytics.use(SegmentIntegration);
// define the integration settings object.
// Since we are using only Segment integration in this example, we only have
// "Segment.io" in the integrationSettings object
const integrationSettings = {
"Segment.io": {
apiKey: "<YOUR SEGMENT WRITE KEY>",
retryQueue: true,
addBundledMetadata: true
}
};
// Initialize the library
analytics.initialize(integrationSettings);
// Happy tracking!
analytics.track('🚀');
Released under the MIT license.
FAQs
The hassle-free way to integrate analytics into any web application.
The npm package @segment/analytics.js-core receives a total of 18,014 weekly downloads. As such, @segment/analytics.js-core popularity was classified as popular.
We found that @segment/analytics.js-core demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 135 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.