
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
@axe-core/webdriverjs
Advanced tools
Provides a chainable axe API for Selenium's WebDriverJS and automatically injects into all frames.
Previous versions of this program were maintained at dequelabs/axe-webdriverjs.
This package does not follow Semantic Versioning (SemVer) but instead uses the major and minor version (but not patch version) of axe-core that the package uses. For example, if the API version is v4.7.2, then the axe-core version used by the package will be v4.7.x. The patch version of this package may include bug fixes and new API features but will not introduce breaking changes.
Install Node.js if you haven't already.
Download and install any necessary browser drivers on your machine's PATH. More on Webdriver setup.
To install the latest version of Chromedriver globally, install browser-driver-manager: npm install -g browser-driver-manager. Then run npx browser-driver-manager install chrome.
Install Selenium Webdriver: npm install selenium-webdriver
Install @axe-core/webdriverjs: npm install @axe-core/webdriverjs
This module uses a chainable API to assist in injecting, configuring, and analyzing axe with WebdriverJS. As such, it is required to pass an instance of WebdriverJS.
Here is an example of a script that will drive WebdriverJS to a page, perform an analysis, and then log results to the console.
const { AxeBuilder } = require('@axe-core/webdriverjs');
const { Builder } = require('selenium-webdriver');
const chrome = require('selenium-webdriver/chrome');
(async () => {
const driver = new Builder()
.forBrowser('chrome')
.setChromeOptions(new chrome.Options().headless())
.build();
await driver.get('https://dequeuniversity.com/demo/mars/');
try {
const results = await new AxeBuilder(driver).analyze();
console.log(results);
} catch (e) {
// do something with the error
}
await driver.quit();
})();
Constructor for the AxeBuilder helper. You must pass an instance of WebdriverJS as the first argument.
const builder = new AxeBuilder(driver);
If you wish to run a specific version of axe-core, you can pass the source of axe-core source file in as a string. Doing so will mean @axe-core/webdriverjs run this version of axe-core, instead of the one installed as a dependency of @axe-core/webdriverjs.
const axeSource = fs.readFileSync('./axe-1.0.js', 'utf-8');
const builder = new AxeBuilder(driver, axeSource);
Performs analysis and passes any encountered error and/or the result object.
new AxeBuilder(driver).analyze((err, results) => {
if (err) {
// Do something with error
}
console.log(results);
});
new AxeBuilder(driver)
.analyze()
.then(results => {
console.log(results);
})
.catch(e => {
// Do something with error
});
Adds a CSS selector to the list of elements to include in analysis
new AxeBuilder(driver).include('.results-panel');
Add a CSS selector to the list of elements to exclude from analysis
new AxeBuilder(driver).include('.some-element').exclude('.another-element');
Specifies options to be used by axe.run. Will override any other configured options. including calls to AxeBuilder#withRules() and AxeBuilder#withTags(). See axe-core API documentation for information on its structure.
new AxeBuilder(driver).options({ checks: { 'valid-lang': ['orcish'] } });
Limits analysis to only those with the specified rule IDs. Accepts a String of a single rule ID or an Array of multiple rule IDs. Subsequent calls to AxeBuilder#options, AxeBuilder#withRules or AxeBuilder#withRules will override specified options.
new AxeBuilder(driver).withRules('html-lang');
new AxeBuilder(driver).withRules(['html-lang', 'image-alt']);
Limits analysis to only those with the specified rule IDs. Accepts a String of a single tag or an Array of multiple tags. Subsequent calls to AxeBuilder#options, AxeBuilder#withRules or AxeBuilder#withRules will override specified options.
new AxeBuilder(driver).withTags('wcag2a');
new AxeBuilder(driver).withTags(['wcag2a', 'wcag2aa']);
Skips verification of the rules provided. Accepts a String of a single rule ID or an Array of multiple rule IDs. Subsequent calls to AxeBuilder#options, AxeBuilder#disableRules will override specified options.
new AxeBuilder(driver).disableRules('color-contrast');
Inject an axe configuration object to modify the ruleset before running Analyze. Subsequent calls to this method will invalidate previous ones by calling axe.configure and replacing the config object. See axe-core API documentation for documentation on the object structure.
const config = {
checks: axe.Check[],
rules: axe.Rule[]
}
new AxeBuilder(driver).configure(config).analyze((err, results) => {
if (err) {
// Handle error somehow
}
console.log(results)
})
Set the frame testing method to "legacy mode". In this mode, axe will not open a blank page in which to aggregate its results. This can be used in an environment where opening a blank page is causes issues.
With legacy mode turned on, axe will fall back to its test solution prior to the 4.3 release, but with cross-origin frame testing disabled. The frame-tested rule will report which frames were untested.
Important Use of .setLegacyMode() is a last resort. If you find there is no other solution, please report this as an issue.
const axe = new AxeBuilder(driver).setLegacyMode();
const result = await axe.analyze();
axe.setLegacyMode(false); // Disables legacy mode
We have created an example test suite showcasing the functionality of axe-core WebdriverJS.
To run the test:
/webdriverjs/tests/examplenpm installnpm testFAQs
Provides a method to inject and analyze web pages using axe
The npm package @axe-core/webdriverjs receives a total of 33,707 weekly downloads. As such, @axe-core/webdriverjs popularity was classified as popular.
We found that @axe-core/webdriverjs demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.