
Research
Malicious NuGet Packages Typosquat Nethereum to Exfiltrate Wallet Keys
The Socket Threat Research Team uncovered malicious NuGet packages typosquatting the popular Nethereum project to steal wallet keys.
@apparts/backend-test
Advanced tools
#+TITLE: @apparts/backend-test #+DATE: [2021-02-11 Thu] #+AUTHOR: Philipp Uhl
This library supports testing @apparts-based backends that use Postgresql databases provide express based APIs.
Add to your =package.json= in the =scripts= section: #+BEGIN_SRC js "testOne": "jest", "test": "jest --watch --detectOpenHandles", "testCoverage": "jest --coverage" #+END_SRC
Create a =jest.config.js= file in the root directory of your project. #+BEGIN_SRC js const jestConfig = require("@apparts/backend-test").getJestConfig();
module.exports = { ...jestConfig, // additional config }; #+END_SRC
Create a =config/db-test-config.json= or =config/db-test-config.js= or export the values as an environment variable with the name =DB_TEST_CONFIG= with this content (as JSON, for the js file you'd need to export the object): #+BEGIN_EXAMPLE { "use": "postgresql", "postgresql": { "host": "localhost", "port": 5432, "user": "postgres", "pw": "", "db": "", "maxPoolSize": 1, "connectionTimeoutMillis": 10000, "idleTimeoutMillis": 10000, "bigIntAsNumber": true } } #+END_EXAMPLE
Create tests. To use this library, start the tests with this on
top:
#+BEGIN_SRC js
const { app, url, error, getPool } = require("@apparts/backend-test")({
testName: "",
// apiContainer: myEndpoint,
...require("./tests/config.js")
});
#+END_SRC
Create a =tests/config.js= for storing test information that is valid for more than one test: #+BEGIN_SRC js const fs = require("fs"); module.exports = { schemas: ["schema-file-name-0001.sql" /, .../] .map(name => fs.readFileSync(name).toString()), apiVersion: 1, }; #+END_SRC
Run tests with #+BEGIN_SRC sh npm run test
npm run testCoverage
npm run testOne #+END_SRC
** Parameters
=require("@apparts/backend-test")= returns a function with the following parameters:
** Returns
=require("@apparts/backend-test")= returns a function wich returns an object with the following key/value pairs:
** Minimal example
=jest.config.js=: #+BEGIN_SRC js const jestConfig = require("@apparts/backend-test").getJestConfig();
module.exports = { ...jestConfig, // additional config }; #+END_SRC
=config/db-test-config.json= as described above
Tests with #+BEGIN_SRC js const { app, url } = require("@apparts/backend-test")({ testName: "", apiVersion: 1 });
test("My test", async () => { // requesting GET "/v/1/test" const response = await request(app).get(url("test")); expect(response.status).toBe(200); }); #+END_SRC
** Full-ish example
#+BEGIN_SRC js const { app, url, checkType, allChecked, error, getPool, } = require("@apparts/backend-test")({ testName: "", apiContainer: require("./myEndpoint"),
// Returns everything that is the same for all endpoints of this
// APIs version: apiVersion, schemas
...require("./tests/config.json") ,
// Insert values for the tests to use.
databasePreparations: [
// Common setup queries can be stored in a file
require("./tests/insertUsers.sql.js"),
// Simple insertations
() => 'INSERT INTO "myTable" (myCollumn) VALUES (1), (2)';
// More complicated calculated values
async () => {
const hash = await require("bcryptjs").hash("password123", 10);
return `INSERT INTO "passwords" (password) VALUES (${hash})`;
};
],
});
const request = require("supertest");
describe("GET test", () => { // Using a variable for the function name makes it easy to copy this // test for another endpoint and not forgot to change the function // name in some places. const functionName = "myEndpoint"; test("Check return code", async () => { // Requesting GET "/v/1/test", using the url function. This makes // it easy to copy this file, edit the tests to reflect api changes // and thus reuse it for the next api version. const response = await request(app).get(url("test")); expect(response.status).toBe(200);
// Checking against the database
// const dbs = getPool();
// await dbs.raw("SELECT ...");
// expect(...);
// Throws if not correct, so no expect is needed
checkType(response, functionName);
});
test("Check error", async () => {
const response = await request(app).get(url("test/error"));
expect(response.status).toBe(400);
expect(response.body).toMatchObject(error("This endpoint fails", "Reason: \"error\""));
checkType(response, functionName);
});
test(("All possible responses tested") => {
// Throws if not all checked, so no expect is needed
allChecked(functionName);
});
}); #+END_SRC
FAQs
A framework for database-incorborating backend-testing
We found that @apparts/backend-test demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
The Socket Threat Research Team uncovered malicious NuGet packages typosquatting the popular Nethereum project to steal wallet keys.
Product
A single platform for static analysis, secrets detection, container scanning, and CVE checks—built on trusted open source tools, ready to run out of the box.
Product
Socket is launching experimental protection for the Hugging Face ecosystem, scanning for malware and malicious payload injections inside model files to prevent silent AI supply chain attacks.