
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@nonvoid/agent-js-codecept
Advanced tools
📋Beautiful enterprise-grade test reports integrated with CodeceptJS testing framework. This helpes you integrate the test results of CodeceptJS with ReportPortal
Based on CodeceptJS RPHelper by PeterNgTr.

@reportportal/agent-js-codecept is a CodeceptJS plugin which can publish tests results on ReportPortal after execution.
When enabled this plugin sends information on test runs to ReportPortal server:
npm i @reportportal/agent-js-codecept --save
This plugin should be added in codecept.conf.js
Example:
{
//...
plugins: {
reportportal: {
enabled: true,
require: '@reportportal/agent-js-codecept',
token: 'YOUR_TOKEN',
endpoint: 'http://localhost:8080/api/v1',
launchName: 'local launch',
}
//...
}
To use this plugin you need to provide the following info:
token: which can be found by navigating to the user profile page, clicking the username drop-down in the right header and selecting the "Profile" > "UUID" – is a unique user identifier. UUID is used in automated test configuration files for a user authentication instead of a password. It will allow you to post data, without logging it in the UI.endpoint: your reportportal host + api/v1 for instance: http://localhost:8080/api/v1launchName: the launch name you want, if not provided, the suite title will be usedprojectName: the project that you created in the reportportal UIlaunchDescription: (optional) the description of your launch, if not provided, the description will be emptylaunchAttributes: (optional) the attributes of your launch, if not provided, the attributes will be emptydebug: (optional) to turn on the debug for reportportalrerun: (optional) to enable rerunrerunOf: (optional) UUID of launch you want to rerun. If not specified, report portal will update the latest launch with the same name.You can send logs to ReportPortal to current step / test by accessing this plugin from your code:
const reportPortal = codeceptjs.container.plugins('reportportal');
reportPortal.addLog({
level: 'debug',
message: 'your message'
});
To send attachment, use second parameter:
const reportPortal = codeceptjs.container.plugins('reportportal');
reportPortal.addLog({
level: 'debug',
message: 'your message'
}, {
name: 'screenshot.png',
type: 'image/png',
content: fs.readFileSync('output/screenshot.png')
});
See sendLog method of ReportPortal JavaScript Client for more oprtions.
Once report is posted a special reportportal.result event is created.
You can use it to pass URL of a report into other plugins. For instance, you can use it to send Slack or Email notifications including a link to a report.
// inside your custom plugin:
event.dispatcher.on('reportportal.result', (result) => {
// use result.link as URL to report
console.log('Report was published at', result.link);
})
run-workers command to aggregate all tests under one launch.To debug this plugin run script enabing DEBUG env variable:
DEBUG="codeceptjs:reportportal" npx codeceptjs run
FAQs
Reportportal plugin for Codecept JS tests
We found that @nonvoid/agent-js-codecept demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.