
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
@nerdwallet/jest-nock-fixtures
Advanced tools
jest-nock-fixtures is a wrapper for a jest testing environment. It uses nock to record and playback requests during test runs. It is heavily inspired by https://github.com/nock/nock#nock-back
npm install @nerdwallet/jest-nock-fixtures
Configure jest to setup this wrapper before the tests in each test file are executed. In jest@24, this can be achieved by configuring setupFilesAfterEnv (https://jestjs.io/docs/en/configuration#setupfilesafterenv-array)
Create a file to import and activate @nerdwallet/jest-nock-fixtures, in this example named setupAfterEvvJestNockFixtures.js
activating the test wrapper
/* setupAfterEvvJestNockFixtures.js */
const createJestNockFixturesTestWrapper = require('@nerdwallet/jest-nock-fixtures');
createJestNockFixturesTestWrapper();
optionally, the error message that is thrown in lockdown mode can be configured. This allows you to hint at ways to fix that might be specific to the repo @nerdwallet/jest-nock-fixtures is used in, ex:
/* setupAfterEvvJestNockFixtures.js */
const createJestNockFixturesTestWrapper = require('@nerdwallet/jest-nock-fixtures');
createJestNockFixturesTestWrapper({
unmatchedErrorMessage: (reqs, { fixtureFilepath }) =>
`unmatched requests not allowed (found ${
reqs.length
}).\n\nRun \`npm run test:record\` to update fixtures, and try again.`
});
then configure jest to activate @nerdwallet/jest-nock-fixtures and wrap each test file in nock fixture recording behavior
// in jest config
{
// ... the rest of the jest config
// run the setup file created in the examples above
setupFilesAfterEnv: ['<rootDir>/setupAfterEvvJestNockFixtures.js'],
// ignore the folder where the fixtures are saved
// so they don't endlessly trigger re-runs in record mode
watchPathIgnorePatterns: ['__nocks__'],
// add the watch plugin to change modes while in --watch mode
// press 'r' to cycle through jest modes between runs
watchPlugins: ['@nerdwallet/jest-nock-fixtures/JestWatchPlugin']
}
Available modes:
dryrun: The default, use recorded nocks, allow new http calls, doesn't record anything, useful for writing new testsrecord: record new nockslockdown: use recorded nocks, disables all http calls even when not nocked, doesn't recordwild: all requests go out to the internet, don't replay anything, don't record anything@nerdwallet/jest-nock-fixtures reads process.env.JEST_NOCK_FIXTURES_MODE to control its behavior, allowing script aliases to be created, for example:
"scripts": {
"jest": "jest --coverage",
"test": "npm run jest --",
"test:wild": "JEST_NOCK_FIXTURES_MODE=wild npm run test --",
"test:record": "JEST_NOCK_FIXTURES_MODE=record npm run test --",
"test:lockdown": "JEST_NOCK_FIXTURES_MODE=lockdown npm run test --"
},
lockdown mode is always used in CI environments (e.g. process.env.CI === true).
An example workflow:
# while developing
npm run test -- --watch
# when ready to push
npm run test:record
# commit and push the added/changed `__nocks__/*.json` fixture files
# and then in CI enjoy peace of mind for consistent and reproducable test runs in the context of network requests
By default, minimal logs will be printed. To increase the verbosity of the logs, set JEST_NOCK_FIXTURES_VERBOSE when running tests. For example:
JEST_NOCK_FIXTURES_VERBOSE=1 npm run test
Main commands:
yarn install: Install all dependenciesyarn test: Run unit tests and generate coverage reportsOther commands you might care about:
yarn lint: Run lintyarn format: Automatically fix code issuespackage.json. Take care to follow semantic versioning.CHANGELOG.md to reflect the changes in the new version.master branch.2.1.0 (2022-12-08)
JEST_NOCK_FIXTURES_VERBOSE environment variable flagFAQs
jest-nock-fixtures
The npm package @nerdwallet/jest-nock-fixtures receives a total of 5 weekly downloads. As such, @nerdwallet/jest-nock-fixtures popularity was classified as not popular.
We found that @nerdwallet/jest-nock-fixtures demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.