Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/Nikita-Filonov/tests-coverage-tool
The Tests Coverage Tool is a comprehensive utility designed to measure code coverage for gRPC services based on their proto contracts. It provides detailed insights into various aspects of your service's coverage, helping you ensure that your tests thoroughly validate your gRPC endpoints. The tool gathers the following metrics:
You can see a report example here.
If you have any questions, you can ask @Nikita Filonov
To install the Tests Coverage Tool, use the following command:
go get github.com/Nikita-Filonov/tests-coverage-tool@latest
Below is an example of how to set up the gRPC client with the coverage interceptor:
package test
import (
"context"
"crypto/tls"
"fmt"
"log"
"testing"
grpcmiddleware "github.com/grpc-ecosystem/go-grpc-middleware"
"google.golang.org/grpc"
"google.golang.org/grpc/credentials"
"github.com/Nikita-Filonov/tests-coverage-tool/tool/coverageinupt"
)
func TestGRPC(t *testing.T) {
// Set up a gRPC client connection with the coverage interceptor
conn, err := grpc.Dial(
"localhost:1000",
grpc.WithTransportCredentials(credentials.NewTLS(&tls.Config{InsecureSkipVerify: true})),
grpc.WithUnaryInterceptor(
grpcmiddleware.ChainUnaryClient(
// Integrate the CoverageInterceptor to track method coverage
coverageinupt.CoverageInterceptor(),
),
),
)
if err != nil {
log.Fatalf("Failed to connect to gRPC server: %v", err)
}
defer conn.Close()
// Initialize the proto service client
client := servicev1.NewServiceClient(conn)
// Call a gRPC method; coverage data will be automatically saved in the specified directory
resp, err := client.Get(context.Background(), &servicev1.GetRequest{})
fmt.Println(resp, err)
}
Before generating the coverage report, ensure that the tests-coverage-tool
is installed. This tool relies on server
reflection to gather data, so your gRPC service must support server reflection; otherwise, the tool will be unable to
measure service coverage.
To install the tool, run:
go install github.com/Nikita-Filonov/tests-coverage-tool/...@latest
Once installed, you can generate the coverage report with the following command:
tests-coverage-tool save-report
This will generate a coverage report based on the results gathered during your test runs.
The tool can be configured via environment variables or a YAML configuration file. Below are the available options:
Environment | YAML | Default | Example |
---|---|---|---|
— | services | — | Defines the gRPC services to monitor. See the example configuration file at ./examples/config-example.yaml |
TESTS_COVERAGE_CONFIG_FILE | — | — | Path to the YAML configuration file. Example: ./examples/config-example.yaml |
TESTS_COVERAGE_RESULTS_DIR | resultsDir | . | Directory where coverage results will be stored. Example: if set to ./tests , results will be stored in ./tests/coverage-results |
TESTS_COVERAGE_HTML_REPORT_DIR | htmlReportDir | . | Directory where the HTML report will be saved |
TESTS_COVERAGE_JSON_REPORT_DIR | jsonReportDir | . | Directory where the JSON report will be saved |
TESTS_COVERAGE_HTML_REPORT_FILE | htmlReportFile | index.html | Name of the HTML report file |
TESTS_COVERAGE_JSON_REPORT_FILE | jsonReportFile | coverage-report.json | Name of the JSON report file |
To save a coverage report, use the following command:
go run ./tests-coverage-tool/main.go save-report
This command will generate and save the coverage report based on the collected test data.
To update and merge submodules and then copy the report, run:
git submodule update --init --recursive
git submodule update --remote --merge
go run ./tests-coverage-tool/main.go copy-report
This command is useful for syncing submodules and copying the report to the desired location.
To print the current configuration, use the following command:
go run ./tests-coverage-tool/main.go print-config
This command outputs the configuration settings currently in use, allowing you to verify and adjust as needed
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.