
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
@mnapoli/exspec
Advanced tools
Executable specs - run Gherkin feature files with an AI agent in the browser
AI writes code. AI writes tests. But confidence comes from tests you actually read and write.
exspec runs plain-text specs in a real browser using AI. No test code, no step definitions. Write specs as acceptance criteria, then let agents build and run exspec to check they pass.

Feature: Order management
Scenario: Place an order and check it appears in the dashboard
Given I am logged in as a store manager
When I create a new order for customer "Alice Martin" with 2 items
Then the order should appear in the orders list with status "Pending"
Scenario: Cancel an order
Given I am logged in as a store manager
And there is at least one pending order
When I open the most recent order and cancel it
Then the order status should change to "Cancelled"
And the customer should see a cancellation notice
$ npx exspec
Suite: 2 scenario(s) in 1 domain(s)
orders (2 scenarios)
✓ Place an order and check it appears in the dashboard
✗ Cancel an order
> `And the customer should see a cancellation notice`
Error: No cancellation notice is visible on the page.
────────────────────────────────────────
Total: 1 passed, 1 failed, 0 skipped, 0 not executed
Detailed results in features/exspec/2026-03-20-1430.md
Unlike Cucumber or Behat, there's no glue code - no step definitions, no page objects, no regex matchers to wire up. The AI agent reads your specs and navigates the app like a real user would. It figures out where to click, what to fill in, and what to check on screen.
This also means specs aren't brittle. Traditional browser tests break when a CSS class changes or a button moves. The AI agent adapts to the actual UI - and if the UX is so broken that a human couldn't complete the task, the spec fails too. That's a feature, not a bug.
Specs are written in Gherkin, a simple Given/When/Then format. You can write them in 70+ languages (English, French, German, Spanish, etc.).
npm install -D @mnapoli/exspec
features/exspec.md configuration file:URL: http://localhost:3000
Use the `test@example.com` / `password` credentials for authentication.
features/:Feature: Shopping cart
Scenario: Add a product to the cart
Given I am logged in
When I navigate to the product catalog
And I add the first product to my cart
Then the cart should show 1 item
npx exspec
That's it. No step definitions to implement, no test code to write.
# Run all feature files
npx exspec
# Run a specific file or directory
npx exspec features/auth/login.feature
npx exspec features/auth/
# Filter by scenario name
npx exspec --filter "invalid password"
# Stop at first failure
npx exspec --fail-fast
# Run with visible browser (for debugging)
npx exspec --headed
# Show agent activity in real-time (tool calls, thinking)
npx exspec --verbose
features/exspec.mdThis file is passed to the AI agent as context. Describe your app, provide credentials, set the URL - anything the agent needs to know to test your application.
URL: http://localhost:3000
## Application
This is an e-commerce app. The user is a store manager.
For detailed feature documentation, see the `docs/` directory.
## Authentication
Use the `test@example.com` / `password` credentials for authentication.
## Browser
Resolution: 1920x1080
You can run shell commands before tests start using YAML frontmatter in exspec.md. This is useful for resetting the database, seeding data, or any other preparation needed before testing.
---
setup: php artisan migrate:fresh --seed
---
URL: http://localhost:3000
...
Setup commands run once before all tests, on the local machine. You can also provide a list of commands:
---
setup:
- php artisan migrate:fresh --seed
---
Scenarios are grouped by subdirectory (domain) and each domain runs as a single agent session. Set domainTimeout (in minutes) to cap how long a domain can run:
---
domainTimeout: 10
---
If the timeout is reached, any unreported scenarios are marked as not_executed. Scenarios already reported before the timeout are preserved.
If your project has a .env file, exspec loads it automatically. You can reference variables in exspec.md with $VAR or ${VAR} syntax:
URL: $APP_URL
.feature files in features/ and groups them by subdirectoryfeatures/exspec/The agent is sandboxed to browser-only interaction. If a scenario can't be verified through the browser, it's marked as FAIL.
Results are written to features/exspec/{YYYY-MM-DD-HHmm}.md with failure screenshots and a real-time activity log (tool calls, timestamps, token usage).
When the agent encounters ambiguous test steps or has to make assumptions, it may include recommendations in its summary.
The CLI exits with code 1 on failures (CI-friendly).
FAQs
Executable specs - run Gherkin feature files with an AI agent in the browser
The npm package @mnapoli/exspec receives a total of 69 weekly downloads. As such, @mnapoli/exspec popularity was classified as not popular.
We found that @mnapoli/exspec demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.