Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
fair-analytics
Advanced tools
An analytics server that doesn't undermine user's privacy
Google Analytics is the de-facto standard in the web and mobile analytics service world.
But it has several serious privacy implications:
Inspired by an interesting article from @staltz, and from the awesome work done by the micro-analytics team, I decided to start working on a Google Analytics alternative.
Fair Analytics is an open, transparent, distributed and fair Google Analytics alternative.
There are 2 ways of running Fair Analytics
npm install -g fair-analytics
fair-analytics
The command accepts some options:
$ fair-analytics --help
Usage: fair-analytics [options] [command]
Commands:
help Display help
Options:
-h, --help Output usage information
-H, --host [value] Host to listen on (defaults to "0.0.0.0")
-m, --memory Use in-memory storage (disabled by default)
-o, --origin [value] Accepts POST requests only from a specified origin (defaults to "*")
-p, --port <n> Port to listen on (defaults to 3000)
-s, --storage-directory [value] Storage directory (defaults to process.cwd())
-v, --version Output the version number
The instance is now running at http://localhost:3000
Add fair-analytics as a dependency to your project
const path = require('path')
const fa = require('fair-analytics')
const server = fa({
storageDirectory: path.resolve(__dirname)
})
const { feed } = server
feed.on('ready', () => {
server.listen(3000, '0.0.0.0')
})
The instance is now running at http://localhost:3000
TODO
The quickest way to start tracking usage is to use fair-analytics-client-api
Example usage:
import fairAnalytics from 'fair-analytics-client-api'
// create a fa instance
const fa = fairAnalytics({
url: 'https://fa.yoursite.com' // the URL of your hosted Fair Analytics instance
})
// track events
fa.send({
event: 'pageView', // event is mandatory and can be anything
pathname: window.location.pathname
})
.then(res => {
if (res.ok) {
console.log('success')
}
})
.catch(err => {
console.error(err.message)
})
Please refer to the fair-analytics-client-api documentation for further details
Fair Analytics responds to 3 endpoints:
Responds with a basic homepage, displaying the feed.key
Used to POST tracked events.
Responds with 204 in case of success (the body MUST be an object containing at least an event
parameter)
Gets realtime updates via server sent events Useful to create real-time dashboards
Consuming real-time data is as easy as:
if (window.EventSource) {
const source = new window.EventSource('https://fa.mysite.com/_live')
source.addEventListener('fair-analytics-event', (e) => {
console.log(e)
})
source.addEventListener('open', () => {
console.log('Connection was opened')
})
source.addEventListener('error', e => {
if (e.readyState === window.EventSource.CLOSED) {
console.log('Connection was closed')
}
})
}
Provides an aggregated view of all the events stored, grouped by event
and pathname
In this case data is persisted to a local JSON file using lowdb
Here is an example response:
{
"pageView":{
"/home":{
"times":640,
"last":"2017-05-04T12:36:31.514Z"
},
"/about":{
"times":40,
"last":"2017-05-04T12:36:31.514Z"
}
}
}
As we said Fair Analytics is distributed. It's easily possible to replicate raw data.
const hyperdrive = require('hypercore')
const swarm = require('hyperdiscovery')
const KEY = 'A FAIR ANALYTICS FEEED KEY'
const LOCALPATH = './replicated.dataset'
const feed = hyperdrive(LOCALPATH, KEY, {valueEncoding: 'json'})
swarm(feed)
feed.on('ready', () => {
// this configuration will download all the feed
// and process new incoming data
// via the feed.on('data') callback
// in case you want to process all the feed (old and new)
// use only {tail: true, tail: true}
feed.createReadStream({
tail: true,
live: true,
start: feed.length,
snapshot: false
})
.on('data', console.log) // Use this callback to precess data as you like
})
$ npm test
This project adheres to Semantic Versioning.
Every release, along with the migration instructions, is documented in the CHANGELOG.md file.
MIT
1.2.2 (2017-10-15)
<a name="1.2.1"></a>
FAQs
Fair Analytics
The npm package fair-analytics receives a total of 4 weekly downloads. As such, fair-analytics popularity was classified as not popular.
We found that fair-analytics demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.