Product
Introducing Webhook Events for Alert Changes
Add real-time Socket webhook events to your workflows to automatically receive software supply chain alert changes in real time.
By Phil Gates-Idem -  Nov 21, 2025
🚀 DAY 5 OF LAUNCH WEEK:Introducing Webhook Events for Alert Changes.Learn more →
tab-ads
A module to manage ads on Tab for a Cause
Overview
The goal of this module is to move ads-specific Tab for a Cause logic out of the app code. It is responsible for:
- defining the ad units that are available to show on Tab for a Cause
- managing each bidder partner's configuration
- calling for bids, ending the auction, fetching ads from the ad server, and displaying them
- providing information on the winning ad for each ad slot
Some of the motivation for this module is to handle bidder partners that are not part of the Prebid ecosystem or need to run outside Prebid. (In a way, it's like a mini Prebid in which Prebid is one of the bidder partners.)
API
fetchAds(config): fetch ads for specified ad units. See config.js for config options.
AdComponent: returns a React AdComponent, which handles ad display.
getAvailableAdUnits: returns an object of available ad units (leaderboard, rectangleAdPrimary, and rectangleAdSecondary). See getAvailableAdUnits.js.
In addition, the module sets window.tabAds with two properties useful for debugging:
getAllWinningBids: a function that returns information on the winning ad for each ad slotadDataStore: storage of each bidder partner's raw and formatted bid responses, as well as Google Ad Manager's slot events
HTML Tags
We must include the following scripts immediately after the <body> tag and before calling tab-ads:
<!--
Google Publisher Tag
-->
<script type="text/javascript">/* eslint-disable */
var googletag = window.googletag || {}
googletag.cmd = googletag.cmd || []
googletag.cmd.push(() => {
googletag.pubads().disableInitialLoad()
googletag.pubads().setTagForChildDirectedTreatment(0)
})
var gads = document.createElement('script')
gads.async = true
gads.type = 'text/javascript'
var useSSL = document.location.protocol === 'https:'
gads.src = (useSSL ? 'https:' : 'http:') +
'//www.googletagservices.com/tag/js/gpt.js'
var head = document.getElementsByTagName('head')[0]
head.appendChild(gads)
</script>
<!--
Amazon apstag
-->
<script>/* eslint-disable */
try {
!function(a9,a,p,s,t,A,g){if(a[a9])return;function q(c,r){a[a9]._Q.push([c,r])}a[a9]={init:function(){q("i",arguments)},fetchBids:function(){q("f",arguments)},setDisplayBids:function(){},targetingKeys:function(){return[]},_Q:[]};A=p.createElement(s);A.async=!0;A.src=t;g=p.getElementsByTagName(s)[0];g.parentNode.insertBefore(A,g)}("apstag",window,document,"script","//c.amazon-adsystem.com/aax2/apstag.js");
} catch(e) {
console.error(e)
}
</script>
We could consider adding a getAdCodeForHTMLBody() function to tab-ads, which apps could use to insert scripts into the page.
Building Prebid from Source
We build Prebid.js from source and keep the built Prebid code in source control. We do this because:
- We can build Prebid to include only the required modules. This reduces the JS bundle size.
- We can patch Prebid to ensure it works as expected in the context of a new tab page. Our users may view the new tab page within an iframe that has a
chrome-extension://ormoz-extension://protocol, and this can break bidders that need to know the correct domain and referrer.
To build a new version of Prebid:
yarn run prebid:build
To modify the Prebid patches:
- modify files as needed in
./node_modules/prebid.js/* - add tests for the patches in
prebidPatches.test.js - run
prebid:create-patchesto update the patches file - run
yarn run prebid:buildto put those patches into effect in the build Prebid file
Verifying Prebid Bidder Requests
In the new tab page iframe context, we need to ensure that Prebid bidders send the correct page URL and referrer info. We don't have automated tests for this yet. To verify, we need to load the page in a new tab page iframe and inspect each partner's network request.
We should check this every time we upgrade Prebid.
Here's what to check for each partner, assuming the iframed page is https://example.com/newtab/:
| Partner | Request URL | What to check |
|---|---|---|
| Magnite | https://fastlane.rubiconproject.com/a/api/fastlane.json | Query param rf is https://example.com/newtab/ |
| Media.net | https://prebid.media.net/rtb/prebid | Payload site.domain is example.com and site.page is https://example.com/newtab/ |
| OpenX | https://tabforacause-d.openx.net/w/1.0/arj | Query param ju is https://example.com/newtab/ |
| Pulsepoint | https://bid.contextweb.com/header/ortb | Payload site.page and site.ref are both https://example.com/newtab/ |
| Sonobi | apex.go.sonobi.com/trinity.json | Query param ref is https://example.com/newtab/ |
| Unruly | https://targeting.unrulymedia.com/unruly_prebid | Payload refererInfo.referer is https://example.com/newtab/ |
GDPR and CCPA: We should manually ensure that data privacy preferences are passed to ad partners. We use tab-cmp as our consent management platform. See tab-cmp's "Ad Partners" sections of its test checklist for what to verify in ad partner requests.
Testing In-Progress Builds in Local Projects
It's often helpful to test development builds of tab-ads in other local projects.
- Install yalc:
yarn global add yalc - In
tab-ads: runyarn run dev:publish - In the consuming project: run
yalc add tab-ads
FAQs
An NPM package to manage ads logic for Tab for a Cause
We found that tab-ads demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Package last updated on 16 Dec 2023
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Related posts
Security News
ENISA Becomes a CVE Root, Expanding Its Role in Europe’s Vulnerability Ecosystem
ENISA has become a CVE Program Root, giving the EU a central authority for coordinating vulnerability reporting, disclosure, and cross-border response.
By Sarah Gooding -  Nov 21, 2025
Product
Introducing Socket Scanning for OpenVSX Extensions
Socket now scans OpenVSX extensions, giving teams early detection of risky behaviors, hidden capabilities, and supply chain threats in developer tools.
By Mix Irving, Ryan Eberhardt -  Nov 20, 2025