
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
@thanksjs/web
Advanced tools
[ThanksJS React-Native](https://www.npmjs.com/package/@thanksjs/react-native-webview) | [ThanksJS React](https://www.npmjs.com/package/@thanksjs/react) | [ThanksJS Web](https://www.npmjs.com/package/@thanksjs/web) | [Integration Examples](https://github.c
ThanksJS React-Native | ThanksJS React | ThanksJS Web | Integration Examples
yarn add @thanksjs/web
import { configureThanksWidget, displayThanksWidget } from '@thanksjs/web';
/// somewhere in your code
configureThanksWidget({
partnerId: 'your partner id',
// other available props, see Thanks Configuration section
});
displayThanksWidget();
It's all comes with TypeScript support, dont worry.
Refer to the full Thanks API configuration documentation for more.
To close widget by request, for example in case of navigation call corresponding function
import { closeThanksWidget } from '@thanksjs/web';
closeThanksWidget();
this call is equal to low-level window.__thanks.closeWidget()
call.
In order to improve the efficiency of Thanks Widget extra information should be provided.
The important parts are:
email
. Strictly sha256 hash will be transferred during the widget lifecycle. No sensitive
information leaves your application without your permission.subject
and info
can be used to decide what information to send
subject
can be notification
or autofill
of visible UI elementsinfo.token
is a unique identifier for the request and can be used to trace PII flow further in our systemskeywords
, category
and items
are used to fine-tune ads to displayExample
configureThanksWidget({
partnerId: 'your partner id',
// information for the first scren
statusText: 'Your order has been confirmed',
emailHash: { sha256: customersEmailHash },
// or
email: customerEmail,
onPersonalInformationRequest: (subject, info) => {
return {
email,
firstName: 'TestUser',
};
},
onDisplay: () => {
console.log('widget displayed');
},
onClose: () => {
console.log('widget closed');
},
keywords: ['violet', 'roses', 'blueberry'],
items: [
{
name: 'Flatwhite',
value: 4.0,
currency: 'AUD',
quantity: 2,
type: 'coffee',
category: 'drinks',
subcategory: 'australian-coffee',
},
],
categories: ['lifestyle'],
});
displayThanksWidget();
By default, Thanks Widget does not send any personal information. The email
specified in configuration is always
converted into sha256 emailHash
before being sent to server. All other extended information provided is used only to
improve the efficiency of the widget and is not stored unless user performs an action. In such case the information will
kept until the action is settled, but no longer than 60 days.
However, there are situations when we need Partner to provide Personal Information:
In both case we are going to call onPersonalInformationRequest
function with subject
and info
arguments. Depending
on request you may decide to return some information, or return nothing.
onPersonalInformationRequest: (subject: 'notification' | 'autofill', info) => {
return {
email,
firstName: 'TestUser',
};
};
notification
will be used to send email notification to the user about the action just taken, for
example coupon code they just claimedautofill
will be used to prefill a form with user's data, making the subscription process friction
lessIn case of onPersonalInformationRequest
is not defined, but email
is provided as a part of configuraiton - nothing
will happen. The process of capturing PII information is always in the Partners hands.
💡It's not always known upfront if PII is required, so onPersonalInformationRequest
will be called more often than PII
information is being "consumed". In case it was not required, the information will be discarded.
While not every Ad requires PII, some Ads can have a "Promotion" attached to them, for example "Subscribe to XYZ newsletter to enter the draw". In case of user action PII information might not be used by a particular Ad, but will be used by Promotion to keep track of participation. The information will be redacted after the Promotion ends.
MIT
FAQs
[ThanksJS React-Native](https://www.npmjs.com/package/@thanksjs/react-native-webview) | [ThanksJS React](https://www.npmjs.com/package/@thanksjs/react) | [ThanksJS Web](https://www.npmjs.com/package/@thanksjs/web) | [Integration Examples](https://github.c
The npm package @thanksjs/web receives a total of 10 weekly downloads. As such, @thanksjs/web popularity was classified as not popular.
We found that @thanksjs/web demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.