
Research
/Security News
CanisterWorm: npm Publisher Compromise Deploys Backdoor Across 29+ Packages
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.
@topsort/banners-avolta
Advanced tools
This is a custom fork of @topsort/banners with additional fallback banner backfill support for Avolta's multi-store setup.
For general usage, configuration, attributes, and API reference, see the upstream documentation.
<script
async
type="module"
src="https://unpkg.com/@topsort/banners-avolta/dist/banners.mjs"
></script>
<script async type="module" src="https://unpkg.com/@topsort/analytics.js"></script>
<script>
window.TS = {
token: "<your topsort api key>",
storeCode: "<your store code>",
};
</script>
For legacy systems that don't support ES modules:
<script src="https://unpkg.com/@topsort/banners-avolta/dist/banners.iife.js"></script>
When an auction returns fewer winners than available slots, the remaining slots can be backfilled with store-specific fallback banners. This is designed for setups where multiple websites share a single slot ID (e.g., "carousel") and each website has a unique store code.
isFallback: true whose asset URL points to a JSON manifeststoreCodeIf all slots are filled by real auction winners, no fallback fetch occurs.
Add storeCode to your window.TS configuration:
window.TS = {
token: "<your topsort api key>",
storeCode: "133",
};
The manifest is a JSON object keyed by store code. Each store maps to an array of fallback banner entries:
{
"133": [
{
"assetURL": "https://cdn.example.com/banner-clinique.jpg",
"assetHref": "https://example.com/brands/clinique",
"description": "Activate Your Glow with Clinique",
"brandName": "Clinique"
},
{
"assetURL": "https://cdn.example.com/banner-la-mer.jpg",
"assetHref": "https://example.com/brands/la-mer",
"description": "Refresh Your Regime with La Mer",
"brandName": "La Mer"
}
],
"52": [
{
"assetURL": "https://cdn.example.com/banner-offers.jpg",
"assetHref": "https://example.com/offers",
"description": "Special offers"
}
]
}
| Field | Type | Description |
|---|---|---|
assetURL | string | URL of the fallback banner image |
assetHref | string | Destination link for the banner |
description | string (optional) | Used as the <img> alt text |
brandName | string (optional) | Brand name for reference |
data-ts-resolved-bid attribute (no attribution tracking)description field from the manifest is used as the image alt texttype: "url" with assetHref as the link destinationThe fallback pipeline degrades gracefully in all failure scenarios:
isFallback meta-winner in the response: remaining slots render nothingstoreCode not configured: remaining slots render nothingThis fork tracks the original banners.js as upstream:
git fetch upstream
git merge upstream/main
FAQs
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.