
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
@apexdevtools/test-runner
Advanced tools
Salesforce unit test runner, built over @salesforce/apex-node and jsforce. The runner provides a number of reliability features aimed at ensuring the greatest chance of obtaining a good test run.
The main abstraction is a Testall command. You can use this to configure and execute a test run. The runner is assisted by three plugins:
The Testall command also handles re-running tests that failed due to locking after the main run(s) have completed.
You can start a Testall run by providing a set of test classes. If you don't provide any the run will execute against all the "local" (non-packaged) tests in the org.
This project uses the pnpm package manager.
pnpm install
pnpm build
To run unit tests:
pnpm test
To test bundling using webpack:
pnpm test:pack
node test-bundle/bundle.js
This should execute without error.
See ./script for some basic scripts to aid org testing. Execute them with ts-node using the run script:
# Run Testall with default settings
pnpm run:script -- ./src/scripts/Testall.ts <username> <namespace | unmanaged>
If you encounter difficulties with the installed git hooks, they can be bypassed with --no-verify/-n flag on commit. To disable them completely (after install) use npx husky uninstall or the direct command git config --unset core.hooksPath.
All the source code included uses a 3-clause BSD license, see LICENSE for details.
FAQs
Apex parallel test runner with reliability goodness
We found that @apexdevtools/test-runner demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.