
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
@usermaven/sdk-js
Advanced tools
Usermaven SDK is a powerful and flexible JavaScript/TypeScript library for tracking user behavior and events in web applications. It supports both client-side and server-side usage, with a focus on privacy, configurability, and robustness.
You can install the Usermaven SDK using npm:
npm install @usermaven/sdk-js
Or using yarn:
yarn add @usermaven/sdk-js
For quick integration without a module bundler, you can include the SDK directly in your HTML using a script tag:
<script src="https://cdn.usermaven.com/sdk/v1/lib.js"
data-key="your-api-key"
data-tracking-host="https://events.yourdomain.com"
data-log-level="debug"
data-autocapture="true"
data-form-tracking="true"
data-auto-pageview="true"></script>
Replace https://cdn.usermaven.com/sdk/v1/lib.js
with the actual URL where the Usermaven SDK is hosted.
import { usermavenClient } from '@usermaven/sdk-js';
const client = usermavenClient({
apiKey: 'your-api-key',
trackingHost: 'https://events.yourdomain.com',
// Add other configuration options as needed
});
// Track an event
client.track('button_click', {
buttonId: 'submit-form',
pageUrl: window.location.href
});
// Identify a user
client.id({
id: 'user123',
email: 'user@example.com',
name: 'John Doe'
});
// Track a page view
client.pageview();
When you include the SDK via a script tag, it automatically initializes with the configuration provided in the data attributes. You can then use the global usermaven
function to interact with the SDK:
<script>
// Track an event
usermaven('track', 'button_click', {
buttonId: 'submit-form',
pageUrl: window.location.href
});
// Identify a user
usermaven('id', {
id: 'user123',
email: 'user@example.com',
name: 'John Doe'
});
// Track a page view (if not set to automatic in the script tag)
usermaven('pageview');
</script>
The SDK supports various configuration options to customize its behavior. When using as a module:
const client = usermavenClient({
apiKey: 'your-api-key',
trackingHost: 'https://events.yourdomain.com',
cookieDomain: '.yourdomain.com',
logLevel: 'DEBUG',
useBeaconApi: true,
autocapture: true,
formTracking: 'all',
autoPageview: true,
// ... other options
});
When using via UMD, you can set these options using data attributes on the script tag:
<script src="https://cdn.usermaven.com/sdk/v1/lib.js"
data-key="your-api-key"
data-tracking-host="https://events.yourdomain.com"
data-log-level="debug"
data-autocapture="true"
data-form-tracking="all"
data-auto-pageview="true"
data-use-beacon-api="true"
data-cookie-domain=".yourdomain.com"></script>
Refer to the Config
interface in src/core/config.ts
for a full list of configuration options.
The SDK can also be used in server-side environments:
const { usermavenClient } = require('@usermaven/sdk-js');
const client = usermavenClient({
apiKey: 'your-api-key',
trackingHost: 'https://events.yourdomain.com'
});
client.track('server_event', {
userId: 'user123',
action: 'item_purchased'
});
To set up the project for development:
npm install
npm test
npm run build
Contributions are welcome! Please read our contributing guidelines and code of conduct before submitting pull requests.
FAQs
Usermaven JavaScript SDK
The npm package @usermaven/sdk-js receives a total of 1,257 weekly downloads. As such, @usermaven/sdk-js popularity was classified as popular.
We found that @usermaven/sdk-js demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.