
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
CLA-WEB-SDK 为前端监控SDK,涵盖错误监控、CGI上报、性能监控。接入SDK简单配置即可完成自动上报,无侵入代码。
npm run build
npm run release
npm install cla-web -s
# 或者
yarn add cla-web
内联引入 (注意:务必在项目头部<head></head>
引入)
/lab/cla.min.js
然后自行复制即可<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta http-equiv="X-UA-Compatible" content="ie=edge">
<title>CLA-WEB-SDK</title>
<script src="/libs/cla.min.js"></script>
</head>
<body>
</body>
</html>
VUE项目中引入 (注意:记得要先执行 npm install cla-sdk)
import Cla from 'cla-web'
引入SDK后,需实例化SDK
注意:appname baseUrl 为必传参数,为空会导致初始化SDK失败,无法正常上报
const claIns = new Cla({
appname: 'fca-wechat-help', // 项目名称
baseUrl: '' // 上报地址,申请后邮件提供
})
appname
即可。名称 | 类型 | 必填 | 默认值 | 说明 |
---|---|---|---|---|
appname | String | 是 | 无 | 项目名称 |
baseUrl | String | 是 | 无 | 上报地址 |
repeat | Number | 否 | 5 | 相同错误最大重复次数 |
off | Boolean | 否 | true | 是否开启 cgi 异常返回码上报 |
delay | Number | 否 | 2000 | 上报延迟时间(ms) |
sampling | Number | 否 | 1 | 错误抽样率 |
timeout | Number | 否 | 20000 | ajax 请求最大延迟时间(ms) |
performance | Boolean | 否 | false | 是否自动上报页面性能加载数据 |
blacklist | Array | 否 | [] | cgi类上报地址黑名单列表 |
claIns
的实例方法 实例化SDK后调用
claIns.report(customLog)
customLog
格式可以为 Error 对象或者自定义对象。const customLog = {
msg: 'custom message',
stack: 'custom report error',
level: 'INFO'
}
// level: INFO/DEBUG/ERROR
claIns.reportPerformance()
在VUE项目中接入SDK后 若定义 Vue.config.errorHandler
方法,建议实例化SDK后调用。claIns.report()
方法手动上报,SDK会自动解析报错信息并上报,若未定义无需额外配置。
Vue.config.errorHandler = function (err, vm, info) {
claIns.report(err)
}
SDK支持通过url参数,获取用户uuid,便于查询特定用户的日志。
http://a.com?cla=1
时,页面弹出提示框,显示用户uuid。FAQs
cla web sdk
The npm package cla-web receives a total of 1 weekly downloads. As such, cla-web popularity was classified as not popular.
We found that cla-web demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.