
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@spring-media/red-sourcepoint-cmp
Advanced tools
CMP (Consent Management Platform) implementation for www.bild.de using the Sourcepoint API
This repository covers the implementation of CMP (Consent Management Platform) for www.bild.de by using the Sourcepoint API.
npm i @spring-media/red-sourcepoint-cmp
The project is organised into several (mostly) independent modules, that are described below:
An API for (hardcoded) mappings of (custom) vendors and purposes and their relations between each other.
An (tiny) abstraction layer for the IAB TCF-V2 specs
An (tiny) abstraction layer for the Sourcepoint API
A collection of utils for handling (social) embeds.
A collection of Vue components for the integration of the API's above.
The purpose of the playground is to test the feature set of our library (manually and automated) within a browser. It uses the compiled modules from the dist folder to provide two small applications, one for the esm bundle and one for the browser bundle.
Start the playground by running the following command:
npm run playground:start
Some questions are asking the first time, with some predefined sensible default settings.
You can use cli parameters to overwrite internal default values as follows:
npm run playground:start -- --propertyId 1234
The example above sets the default value for propertyId to 1234.
You can also use --yes to skip the questionnaire altogether. In this case, the internal default values (or provided by cli) will be used as the parameters for the playground.
Use a modern browser for testing because the code is not transformed to be compatible with older browsers that do not fully support ES6.
In addition to manual testing, there is also the option of automatically testing the playground through end-2-end tests.
In order to do so, make sure the playground application is running (npm run playground:start
) and then (in another terminal) run npm run playground:test:e2e
.
The tests use some values from the parameters.json file, which is automatically created in the build directory after the playground has been prepared.
This repository uses semantic release for automated releasing and publishing to the npm registry and github.
Each release step is configured via release config by configurable plugins.
Semantic-release uses the commit messages to determine the type of changes in the codebase. To automatically determine the next semantic version number and automate publishing the release following commit message format is required:
<type>(<scope>): <subject>
must be one of the following:
The scope could be anything specifying place of the commit change. You can use * when the change affects more than a single scope.
The subject contains succinct description of the change:
FAQs
CMP (Consent Management Platform) implementation for www.bild.de using the Sourcepoint API
The npm package @spring-media/red-sourcepoint-cmp receives a total of 3 weekly downloads. As such, @spring-media/red-sourcepoint-cmp popularity was classified as not popular.
We found that @spring-media/red-sourcepoint-cmp demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.