
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@batterii/fake-query
Advanced tools
This module exposes a fake Objection query builder for unit tests. It is built using Sinon and is intended to be used in conjunction with it.
A named export of this module, the FakeQuery exposes a fake QueryBuilder
instance on its builder property. You can inject the fake into your code under
test by stubbing the static ::query method on the desired model.
The fake builder automatically creates sinon stubs for any property accessed on
the builder, except for the #then and #catch methods used to execute the
query and obtain its result, as well as the #inspect method which prints out
a string representation of the builder.
Created stubs always return this, as all QueryBuilder methods are chainable.
Test code can examine the stubs property to write assertions about the query.
Typically, you will want to do a keys assertion on the stubs object, followed by
sinon assertions on the stubs themselves.
By default, the fake builder will neither resolve or reject when executed, as is
normal for sinon stubs. If you want it to resolve or reject, simply involve the
#resolves or #rejects methods with the desired result value.
Once the fake builder has been executed, it can no longer be changed. If any of
its instance methods are invoked, or if you attempt to change its result with
#resolves or #rejects, the invoked method will throw. This ensures that your
assertions are always referring to the state of the builder when it was
executed, and not after.
import {FakeQuery} from "@batterii/fake-query";
import {MyModel} from "../path/to/my-model";
import chai from "chai";
import sinon from "sinon";
import sinonChai from "sinon-chai";
chai.use(sinonChai);
const {expect} = chai;
describe('functionUnderTest', function() {
let qry: FakeQuery;
beforeEach(function() {
qry = new FakeQuery();
// Make sure this stub is cleaned up! See the `afterEach` below.
sinon.stub(MyModel, "query").returns(qry.builder);
});
afterEach(function() {
sinon.restore();
});
it("deletes the things", async function() {
const deletedThings = [];
qry.resolves(deletedThings);
const result = await functionUnderTest();
expect(MyModel.query).to.be.calledOnce;
expect(MyModel.query).to.be.calledOn(MyModel);
expect(MyModel.query).to.be.calledWithExactly();
expect(qry.stubs).to.have.keys(["delete", "where", "returning"]);
expect(qry.stubs.delete).to.be.calledOnce;
expect(qry.stubs.delete).to.be.calledWithExactly();
expect(qry.stubs.where).to.be.calledOnce;
expect(qry.stubs.where).to.be.calledWith("id", ">", 42);
expect(qry.stubs.returning).to.be.calledOnce;
expect(qry.stubs.returning).to.be.calledWith("*");
expect(result).to.equal(deletedThings);
});
});
// Any non-cosmetic changes to this function will cause the above test to fail.
async function functionUnderTest(): Promise<MyModel[]> {
return MyModel.query()
.delete()
.where('id', '>', 42)
.returning('*');
}
FAQs
Fake Objection query builder for unit tests
The npm package @batterii/fake-query receives a total of 42 weekly downloads. As such, @batterii/fake-query popularity was classified as not popular.
We found that @batterii/fake-query demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.