Skip to content

Analytics Script Build (Build 1.3555) | SlaveAPI #2314

@TheProdigyLeague

Description

@TheProdigyLeague

#2310
#2311

Performance Impact SingularityBase/src/main/java/com/hubspot/mesos/json/MesosTaskStatisticsObject.java

https://js.na1.hs-scripts.com/2734547.js

Tracking Script:

  • Likely singularity.js
  • 2025©️ HUBS INC
  • A multitude of high volume jquery HUBS singularity.js hash-trackers.

Data-points observed (via network)

  1. Initialization of Page Tracking:
  • _hsq.push(['setPortalId', <insert_hash_algorithm_here>]):
  • _hsq.push(['trackPageView']);
  1. Aggressive Click Tracking Events:
  • ADOBE INC sign - enable - button:

• Selector:

div#mpc_button_set-3160da0ab281d80.mpc-button-set.mpc-style--horizontal.mpc-inited 
> a.mpc-button.mpc-transition.mpc-typography--default.mpc-inited:eq(1) 
> div.mpc-button__content.mpc-effect-type--stay.mpc-effect-side--right 
> span.mpc-button__title.mpc-transition

• Event ID: pe2734547_adobe_sign___enable

• URL: https://www.avionte.com/avionte_partners/adobe-sign-profile/

• Tracking Config ID: 15036281

• Adobe Sign - Demo Button:

• Selector:

div#mpc_button_set-3160da0ab281d80.mpc-button-set.mpc-style--horizontal.mpc-inited

> a.mpc-button.mpc-transition.mpc-typography--default.mpc-inited:eq(2) 

> div.mpc-button__content.mpc-effect-type--stay.mpc-effect-side--right 

> span.mpc-button__title.mpc-transitionEvent ID: pe2734547_adobe_sign___demo

• URL: https://www.avionte.com/avionte_partners/adobe-sign-profile/•Tracking Config ID: 15036282

ADP ©️

• ADP - Demo Button:

•Selector:

div#mpc_button_set-2160da2130edacd.mpc-button-set.mpc-style--horizontal.mpc-inited 

> a.mpc-button.mpc-transition.mpc-typography--default.mpc-inited:eq(2) 
> div.mpc-button__content.mpc-effect-type--stay.mpc-effect-side--right 
> span.mpc-button__title.mpc-transitionEvent ID: pe2734547_adp___demo

• URL: https://www.avionte.com/avionte_partners/adp-profile/

•Tracking Config ID: 15036296

•ADP - Enable Button:•Selector:

div#mpc_button_set-2160da2130edacd.mpc-button-set.mpc-style--horizontal.mpc-inited 

> a.mpc-button.mpc-transition.mpc-typography--default.mpc-inited:eq(1) 
> div.mpc-button__content.mpc-effect-type--stay.mpc-effect-side--right 
> span.mpc-button__title.mpc-transitionEvent ID: pe2734547_adp___enable

•URL: https://www.avionte.com/avionte_partners/adp-profile/

• Tracking Config ID: 15036307

  1. Cookie Domain Configuration:

•_hsq.push(['setLegacy', false]);

• Multiple _hsq.push(['addHashedCookieDomain', '...']); calls:

• 233546881

• 208532173

• 224894981

• 135882094

• 20629287

• 251652889

• 121210071

• 199273009

• 1084633254.

Other Configurations:

_hsq.push(['enableAutomaticLinker', true]);

_hsq.push(['embedHubSpotScript', 'https://js-na1.hs-scripts.com/2734547.js', 'hs-script-loader']);

_hsq.push(['initEventVisualizerScript']);•_hsq.push(['setTrackingDomain', 'track.hubspot.com']);

Observations

🚩 Bug with click-tracking: When click tracking events are configured for specific buttons I.e. 'submit buttons' hosted via third-party vendor snippets. The above can show how the data can be manipulated for malicious click-tracking/puppeteering events.

🚩 Concern for hashed domains: The sheer number of these hash domain events (which I have counted to be nine) addHashedCookieDomain. Which are API calls. I understand this is for cross-domain tracking. However, it raises deep concerns for specific implementations. (Mishandling).

🚩Script Headers ©️ : The project indicates "no longer maintained." However, upon further research, the company still has a pulse. Specifically, the builds suggest future releases and dependency management. (Singularity).

🚩 Script Performance: The impact of third-party scripts can lead to functionality issues. "Lighthouse heap analysis". The anomalies investigated leads to severe deprecation of builds due to LinkedIn. (Disallowing anything but Windows 11). Which is a clear and evident bias. (Excluding non-latest-windows builds). Specifically with the initEventVisualizerScript and other hashIdPortals using the SlaveAPI key.

🚩 CSS Selectors: Many Selectors appear to be bloat code which points to the DOM structuring. This raises a significant red flag because improper UI changes breaks the entire build. Specifically div#mpc_button_set-3160da0ab281d80...


**Questions:

Why does the click element correspond with a third-party selector configuration and how it may be tracked with incorrect data?

Does cross-domain tracking impact cookie management and have performance implications we should be aware of? Are your domains being actively used for necessary Portal ID's?

Does HubSpot offer guidance on more robust selector strategies for custom click tracking, or is there a way to simplify these from the HubSpot configuration UI?

⚠️ This review and technical analysis along with the accompanying viewpoints was conducted via a manual investigation from the verified Developer z4xk3r07h ©️ The Prodigy League ™️ Zaxkeroth ®️ . This content 100% relevant and was NOT created by GenerativeAI, Agentic AI, or another automation scheme. The committed insights were Ethically tested and ensures the expertise by the authors own certified environment on UNIX Time: 1758653856627

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions