
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
datareportjs
Advanced tools
数据上报 JavaScript SDK,统一事件上报格式,支持浏览器/设备信息自动采集、自动埋点、版本注入与 UMD/ESM 双产物,适配 React/TS 项目。
npm i datareportjs
# or
yarn add datareportjs
# or
pnpm add datareportjs
浏览器(CDN / 本地构建产物):
<script src="./dist/datareport.min.js"></script>
<script>
const dr = new window.DataReport({ serverUrl: 'https://your-endpoint' });
dr.autoTrack({ appLaunch: true, pageView: true });
dr.track('custom_event');
</script>
import DataReport from 'datareportjs';
const dr = new DataReport({
serverUrl: 'https://your-endpoint',
appKey: 'your-app-key', // 可选,用于请求头 AppKey
uuid: 'your-uuid', // 可选,不传则自动生成并持久化
debug: true // 可选,开启调试日志
});
dr.autoTrack({ appLaunch: true, pageView: true, click: true });
dr.track('deposit_popup', {
cdid: '10002',
'pop-up_type': 4,
app_version: '1.6.2',
'#title': document.title,
'#url': location.href
});
在 React 中建议将 dr 作为单例放在模块级或依赖注入,组件内直接调用 dr.track。
SDK 每次上报都会生成如下结构(简化示例):
{
"uid": "<uuid>",
"flt": 1754447545,
"session": "<session-uuid>",
"ssid": "<ssid>",
"zo": 480,
"lang": "en",
"width": 390,
"height": 844,
"sdk": 2,
"sdkv": "1.0",
"adtk": 1,
"os": "iPhone",
"osi": 0,
"osv": "18.5",
"dtype": 1,
"brand": "Apple",
"model": "iPhone",
"ts": 1757909194663,
"sco": 1,
"bps": {
"#platform": "H5",
"#browser": "Mobile Safari",
"#browserv": "18.5",
"#duration": "",
"#referrer": "https://example.com/",
"#title": "Page Title",
"#url": "https://example.com/profile"
},
"events": [
{
"ts": 1757909190570,
"eid": "deposit_popup",
"cdid": "10002",
"props": {
"pop-up_type": 4,
"#title": "title",
"#url": "https://example.com/profile"
}
}
]
}
flt 字段记录 SDK 在页面的首次加载时间(Unix 时间戳),使用 sessionStorage 存储,直到用户刷新页面才重新计算。os 字段直接使用 navigator.platform 的值(如 "iPhone", "Win32", "MacIntel"),osi 为原来的数字逻辑值(0 iOS, 1 Android, 2 Windows, 3 MacOS, 4 Linux, 9 Unknown),osv 从 userAgent 提取版本号。bps 包含丰富的页面和浏览器信息,所有字段均使用 # 开头:
#platform:系统平台(H5)#browser/#browserv:浏览器名称和版本#duration:事件时长(由具体事件设置)#referrer/#title/#url:来源地址、页面标题、完整 URLuid;不传则自动生成并持久化bps 的自定义属性注:构建时通过 Rollup @rollup/plugin-replace 将 __APP_VERSION__ 注入到 SDK 内部,作为 AppVersion 默认值,参与 bps.app_version 与请求头 AppVersion。
uuid 等。AppVersion,将更新内部 appVersion,但不会写入 envOptions。track 的 props 中自动合并。events: [{...}] 并立即上报。cdid 字段;props 与 setUserProperties 合并。Content-Type: application/json、AppKey(如实例化时传入)、AppVersion。appLaunch、appShow、appHide、pageView、click#title、#url 等常用属性;click 还包含 tagName、id、className。rollup.config.mjs 集成:
@rollup/plugin-replace 将 package.json.version 注入为 __APP_VERSION__dist/datareport.min.js(UMD)与 dist/datareport.esm.js(ESM)AppVersion: <version>;同时 bps.app_version 也使用该版本。types/index.d.ts 类型声明,exports 已配置 types,开箱即用。dr,在路由切换时调用 dr.track('pageView', {...})。demo.html,可本地打开测试,上屏展示 Headers/Body/Response 片段。npm login
npm version patch # or minor / major
npm run build
npm publish # 确保 package.json 未设置 private: true
ISC
FAQs
数据上报 JavaScript SDK,支持事件追踪、用户属性管理和 debug 模式
The npm package datareportjs receives a total of 81 weekly downloads. As such, datareportjs popularity was classified as not popular.
We found that datareportjs demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.