
Research
/Security News
5 Malicious Rust Crates Posed as Time Utilities to Exfiltrate .env Files
Published late February to early March 2026, these crates impersonate timeapi.io and POST .env secrets to a threat actor-controlled lookalike domain.
@eggjs/bin
Advanced tools
egg developer tool, base on oclif.
npm i @eggjs/bin --save-dev
Add egg-bin to package.json scripts:
{
"scripts": {
"dev": "egg-bin dev",
"test-local": "egg-bin test",
"test": "npm run lint -- --fix && npm run test-local",
"cov": "egg-bin cov",
"lint": "eslint .",
"ci": "npm run lint && npm run cov"
}
}
All the commands support these specific options:
--inspect--inspect-brk--typescript / --ts enable typescript support. Auto detect from package.json's pkg.egg.typescript,
or pkg.dependencies.typescript/pkg.devDependencies.typescript.--base / --baseDir application's root path, default to process.cwd().--require will add to execArgv, support multiple. Also support read from package.json's pkg.egg.require--dry-run / -d whether dry-run the test command, just show the commandegg-bin [command] --inspect
egg-bin [command] --inspect-brk
egg-bin [command] --typescript
egg-bin [command] --base /foo/bar
Start dev cluster on local env, it will start a master, an agent and a worker.
egg-bin dev
--framework egg web framework root path.--port server port. If not specified, the port is obtained in the following order: egg.js configuration config/config.*.js > process.env.EGG_BIN_DEFAULT_PORT > 7001 > other available ports.--workers worker process number, default to 1 worker at local mode.--sticky start a sticky cluster server, default to false.Create .vscode/launch.json file:
{
"version": "0.2.0",
"configurations": [
{
"type": "node",
"request": "launch",
"name": "Egg Debug",
"runtimeExecutable": "npm",
"runtimeArgs": [
"run",
"dev",
"--",
"--inspect-brk"
],
"console": "integratedTerminal",
"restart": true,
"autoAttachChildProcesses": true
},
{
"type": "node",
"request": "launch",
"name": "Egg Test",
"runtimeExecutable": "npm",
"runtimeArgs": [
"run",
"test-local",
"--",
"--inspect-brk"
],
"autoAttachChildProcesses": true
}
]
}
Using mocha to run test.
egg-bin test [...files] [options]
files is optional, default to test/**/*.test.tstest/fixtures, test/node_modules is always exclude.test/.setup.tsIf test/.setup.ts file exists, it will be auto require as the first test file.
test
├── .setup.ts
└── foo.test.ts
You can pass any mocha argv.
--timeout milliseconds, default to 60000--changed / -c only test changed test files(test files means files that match ${pwd}/test/**/*.test.(js|ts))--parallel enable mocha parallel mode, default to false.--auto-agent auto start agent in mocha master agent.--jobs number of jobs to run in parallel, default to os.cpus().length - 1.--mochawesome enable mochawesome reporter, default to true.Environment is also support, will use it if options not provide.
You can set TESTS env to set the tests directory, it support glob grammar.
TESTS=test/a.test.ts egg-bin test
And the reporter can set by the TEST_REPORTER env, default is spec.
TEST_REPORTER=doc egg-bin test
The test timeout can set by TEST_TIMEOUT env, default is 60000 ms.
TEST_TIMEOUT=2000 egg-bin test
Using mocha and [c8] to run code coverage, it support all test params above.
Coverage reporter will output text-summary, json and lcov.
You can pass any mocha argv.
-x add dir ignore coverage, support multiple argv--prerequire prerequire files for coverage instrument, you can use this options if load files slowly when call mm.app or mm.cluster--typescript enable typescript support. If true, will auto add .ts extension and ignore typings and d.ts.--c8 c8 instruments passthrough. you can use this to overwrite egg-bin's default c8 instruments and add additional ones.
- egg-bin have some default instruments passed to c8 like
-rand--temp-directoryegg-bin cov --c8="-r teamcity -r text" --c8-report=true
You can set COV_EXCLUDES env to add dir ignore coverage.
COV_EXCLUDES="app/plugins/c*,app/autocreate/**" egg-bin cov
See https://oclif.io/docs/configuring_your_cli/
Made with contributors-img.
FAQs
egg developer tool
We found that @eggjs/bin demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 13 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Published late February to early March 2026, these crates impersonate timeapi.io and POST .env secrets to a threat actor-controlled lookalike domain.

Security News
A recent burst of security disclosures in the OpenClaw project is drawing attention to how vulnerability information flows across advisory and CVE systems.

Research
/Security News
Mixed-script homoglyphs and a lookalike domain mimic imToken’s import flow to capture mnemonics and private keys.