
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@times-components/ad
Advanced tools
Ads use GPT (Google Publisher Tag) to select and serve targeted ads. GPT is an ad tagging library for DFP (Doubleclick For Publishers) that can dynamically build ad requests. GPT takes key details (targeting parameters) such as ad unit name, ad size, and custom targeting, builds the request, and displays the ad on web pages.
When an advert is still loading or the app is offline, the ad component will show a placeholder image.
DFP is used by the commercial team to set up the campaigns. They use this to configure:
Contact the internal commercial team for a list of targeting keys and their relative descriptions.
These are the parameters which are generic to the page such as the user cookie, page title etc. To list all current targeting keys in the console:
googletag.pubads().getTargetingKeys();
To see the value for a specific key:
googletag.pubads().getTargeting('example_key');
These are the params which are specific to each slot on the page. We can have more than on the slot on the page.
This mechanism helps us to determine if a certain Ad should not be shown on a particular page (e.g. because it contains terror or hate speech related content).
We use ADmantx as a Times brand safety mechanism. We send a uri to ADmantx, which crawls the page and returns an object of key value pairs they associate with that web page. The object has the follow keys: admants
, categories
, feelings
, entities
.
This object is then passed to the DFP code via page targeting, which determines whether to show ads or not.
We have distinct positions on a page where we can display Ads. We refer to them as ad slots with a unique identifiers so that we can request ads for those positions uniquely from DFP. Each ad slot allows for certain fixed ad sizes.
To test Ads in general, follow below steps:
googletag.openConsole();
on the console, this will open a DFP console
on the page and will display all the info about the ads on the page.googletag.pubads().getSlots();
.cust_params
key
has the page level config values and prev_scp
has the slot level config
values.euasync01.admantx.com
to see the key
values that we get from ADmantx.This is an advanced programmatic technique, wherein publishers request for bids from some ad-exchanges simultaneously before actually making calls to their ad servers. The idea is that by letting multiple bidders bid for the same ad slot at the same time, publishers increase their yield and make more money. The returned bids are then passed to the ad server.
Prebid is a free open source library that helps publishers
implement header bidding. We load a prebid script which adds a pbjs
object
onto the window
object. The gpt request waits for prebid request to fulfill.
These are some of the bidders:
Note: Test with local.thetimes.co.uk (some of the ads look for the domain from which the request is coming)
pbjs.getBidResponses();
on the console, this gets all the bids we
have received for all the slots on the pageapstag.debug('enable');
and refresh page [This forces amazon ads to win]googletag.pubads().getSlots().map(s=>s.getTargetingMap());
in the
console, the key hb_bidder
is the winner for the slotPlease read CONTRIBUTING.md before contributing to this package
Please see our main README.md to get the project running locally
The code can be formatted and linted in accordance with the agreed standards.
yarn fmt
yarn lint
This package uses yarn (latest) to run unit tests on each platform with jest.
yarn test:web
Visit the official storybook to see our available ads templates.
Ads do not responsively resize at the moment, which is something we intend to rectify in the near future. Also, brand protection leaves a blank advert on the page at the moment, rather than a placeholder or nothing at all. We intend to improve on this feature soon.
FAQs
Ad component
The npm package @times-components/ad receives a total of 397 weekly downloads. As such, @times-components/ad popularity was classified as not popular.
We found that @times-components/ad demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.