
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@datlas/instrument-cra
Advanced tools
Little module for CRA applications to instrument code without ejecting react-scripts
Little module for CRA applications to instrument code without ejecting react-scripts
yarn add @cypress/instrument-cra
Then change your npm start script to require this module before starting the dev server
{
"scripts": {
"start": "react-scripts -r @cypress/instrument-cra start",
}
}
This module assumes standard Create-React-App v3 JavaScript application with source files in the "src" folder.
When the app starts with yarn start, you should see the coverage information under window.__coverage__ information.

The instrumentation is done using Istanbul.js via babel-plugin-istanbul and is compatible with @cypress/code-coverage plugin.
If you want to exclude files from coverage, for example src/serviceWorker.js, add an object named nyc to package.json following the nyc CLI configuration.
{
"nyc": {
"exclude": "src/serviceWorker.js"
}
}
To instrument a fork of react-scripts, provide the path to the new webpack.config.js in your package.json as cypressWebpackConfigPath, e.g.:
{
"cypressWebpackConfigPath": "./node_modules/@my-org/my-react-scripts-fork/config/webpack.config.js"
}
Usually, the code is only instrumented in the development environment. If you want to force the instrumentation, set the environment variable
CYPRESS_INSTRUMENT_PRODUCTION=true
Run with environment variable DEBUG=instrument-cra to see the verbose logs
If you try to start the application, and react-scripts shows an error There might be a problem with the project dependency tree., just create a local file .env with. The problem is due to several versions of babel-loader dependency between this plugin and your application.
SKIP_PREFLIGHT_CHECK=true
MIT License, see LICENSE
FAQs
Little module for CRA applications to instrument code without ejecting react-scripts
We found that @datlas/instrument-cra demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.