
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Use Google Analytics' Event Tracking everywhere in your Rails app!
This gem alllows you to annotate events everywhere in the code of your Rails app. A rack middleware is automatically inserted into the stack. It transports the event data to the client. Normal requests get a DIV injected, Ajax requests get a data-pounded custom HTTP header appended. In case of redirects the data survives inside of rack a rack session. The asset pipeline-ready CoffeeScript extracts this data on the client-side and pushes it to Google Analytics via gtag.js or Google Tag Manager.
Add it to your Gemfile
with:
gem 'ga_events'
Run the bundle
command to install it.
Add to the top of your application.js
(but after requiring jQuery):
//= require ga_events.js
After requiring ga_events.js
, you have to choose an adapter.
GaEvents.Event.adapter = function() {
return new GaEvents.GTagAdapter();
}
Optionally you can specify a custom tracker GA_MEASUREMENT_ID where you want your events to be sent to:
GaEvents.Event.adapter = function() {
return new GaEvents.GTagAdapter(
{tracker_name: "GA_MEASUREMENT_ID"}
);
}
The default names of the analytics object for gtag.js
is window.gtag()
. If
you have renamed your analytics object, you can specify the name:
GaEvents.Event.adapter = function() {
return new GaEvents.GTagAdapter(
{analytics_object_name: "analytics"} // calls window.analytics()
);
}
If you are using Google Tag Manager you can add custom events which are then passed through to Google Analytics.
GaEvents.Event.adapter = function() {
return new GaEvents.GoogleTagManagerAdapter("event_name"); // defaults to ga_event
}
Events are flushed immediatly by default. If you need to wait for user consent
you can set GaEvents.Event.require_user_consent = true
.
With require_user_consent
enabled all events are buffered until
GaEvents.Event.user_consent_given = true
is set. Events are flushed as soon
as GaEvents.Event.flush()
is called.
For your testing pleasure we included NullAdapter
.
GaEvents.Event.adapter = function() {
return new GaEvents.NullAdapter();
}
On the server-side a new event is added to a list, serialized into a container element and then added to your HTML response. On Ajax requests a custom HTTP header is added to the response.
You can create a new event like this:
GaEvents::Event.new('example_event', { extra: 'dimension' })
On the client-side there is a similar interface to GaEvents:
new GaEvents.Event('example_event', { extra: 'dimension' })
We have taken special care of tracking events while the DOM is loading. Events get collected until the DOM is ready and flushed afterwards.
Use something like this snippet to get informed of bloating HTTP headers with event data:
class ApplicationController < ActionController::Base
after_filter :too_many_ga_events?
private
def too_many_ga_events?
if (serialized = GaEvents::List.to_s).length > 1_024
notify("GaEvents too big: #{serialized}")
end
true
end
end
Middlewares aren't loaded in controller specs, so you have to initialize
GaEvents by hand. You can do this eg. in your spec_helper.rb
:
RSpec.configure do |config|
[...]
config.before(:each, type: :controller) do
GaEvents::List.init
end
end
Yes please! Use pull requests.
FAQs
Unknown package
We found that ga_events demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.