
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@sucoza/api-mock-interceptor-devtools-plugin
Advanced tools
DevTools plugin for intercepting, mocking, and modifying API responses
A powerful DevTools plugin for intercepting, mocking, and modifying API responses directly in the browser. Perfect for development, testing, and debugging scenarios.
fetch and XMLHttpRequest callsnpm install @sucoza/api-mock-interceptor-devtools-plugin
import React from 'react';
import { ApiMockInterceptorPanel, createApiMockInterceptorDevToolsClient } from '@sucoza/api-mock-interceptor-devtools-plugin';
// Create the DevTools client
const client = createApiMockInterceptorDevToolsClient();
function App() {
return (
<div className="h-screen">
<ApiMockInterceptorPanel />
</div>
);
}
export default App;
import React from 'react';
import { useInterceptor } from '@sucoza/api-mock-interceptor-devtools-plugin';
function CustomComponent() {
const { state, actions, selectors } = useInterceptor();
const handleCreateRule = () => {
const rule = {
id: 'test-rule',
name: 'Test Mock Rule',
enabled: true,
priority: 1,
matcher: {
urlPattern: '/api/users/*',
method: 'GET',
},
mockResponse: {
status: 200,
headers: { 'content-type': 'application/json' },
body: { users: [], total: 0 },
},
createdAt: Date.now(),
updatedAt: Date.now(),
};
actions.addMockRule(rule);
};
return (
<div>
<p>Total API Calls: {state.stats.totalCalls}</p>
<p>Mocked Calls: {state.stats.mockedCalls}</p>
<button onClick={handleCreateRule}>Add Test Rule</button>
</div>
);
}
ApiInterceptorHandles the core interception of fetch and XMLHttpRequest calls.
import { getApiInterceptor } from '@sucoza/api-mock-interceptor-devtools-plugin';
const interceptor = getApiInterceptor();
interceptor.enableInterception();
interceptor.addListener((apiCall) => {
console.log('API call intercepted:', apiCall);
});
RequestMatcherEngineManages request matching logic for mock rules.
import { getRequestMatcher } from '@sucoza/api-mock-interceptor-devtools-plugin';
const matcher = getRequestMatcher();
const isMatch = matcher.matches(request, {
urlPattern: '/api/users/*',
method: 'GET'
});
MockResponseEngineGenerates mock responses and simulates network conditions.
import { getMockResponseEngine } from '@sucoza/api-mock-interceptor-devtools-plugin';
const mocker = getMockResponseEngine();
const response = await mocker.createMockResponse(request, {
status: 200,
body: { message: 'Hello from mock!' },
delay: 1000
});
useInterceptor()Main hook for interacting with the interceptor state.
const { state, actions, selectors } = useInterceptor();
// State access
state.apiCalls // All recorded API calls
state.mockRules // All mock rules
state.mockScenarios // All mock scenarios
state.isInterceptionEnabled // Current interception status
// Actions
actions.enableInterception() // Enable API interception
actions.disableInterception() // Disable API interception
actions.addMockRule(rule) // Add new mock rule
actions.toggleMockRule(id) // Enable/disable specific rule
actions.clearApiCalls() // Clear all recorded calls
// Selectors
selectors.getFilteredApiCalls() // Get filtered API calls
selectors.getEnabledMockRules() // Get active mock rules
selectors.getSelectedCall() // Get currently selected call
Define which requests should be mocked:
const matcher = {
// Exact URL match
url: 'https://api.example.com/users',
// Pattern matching (supports * wildcards and regex)
urlPattern: '/api/users/*', // or '/api\/users\/\d+/'
// HTTP method(s)
method: 'GET', // or ['GET', 'POST']
// Header matching
headers: {
'authorization': 'Bearer *',
'content-type': 'application/json'
},
// Request body matching
body: { userId: 123 }
};
Define the mock response to return:
const mockResponse = {
status: 200,
statusText: 'OK',
headers: {
'content-type': 'application/json',
'x-custom-header': 'mock-value'
},
body: {
id: '{{random_uuid}}',
name: 'John Doe',
timestamp: '{{iso_date}}',
requestUrl: '{{request.url}}'
},
delay: 500 // milliseconds
};
Supported template variables in response bodies:
{{timestamp}} - Current timestamp{{iso_date}} - Current ISO date string{{random_id}} - Random ID string{{random_uuid}} - Random UUID v4{{random_number}} - Random number{{random_string}} - Random string{{request_method}} - Original request method{{request_url}} - Original request URL{{request.field}} - Extract field from request objectSimulate various network conditions:
actions.setNetworkConditions({
latency: 1000, // Add 1 second delay
failureRate: 0.1, // 10% chance of failure
offline: false, // Simulate offline mode
throttling: {
downloadThroughput: 50000, // 50KB/s download
uploadThroughput: 25000 // 25KB/s upload
}
});
import { getStorageEngine } from '@sucoza/api-mock-interceptor-devtools-plugin';
const storage = getStorageEngine();
const config = storage.exportData();
console.log(JSON.stringify(config, null, 2));
const importResult = storage.importData(configData);
if (importResult.success) {
console.log(`Imported ${importResult.imported.rules} rules and ${importResult.imported.scenarios} scenarios`);
}
The plugin is fully typed with TypeScript. Key interfaces:
import type {
ApiCall,
MockRule,
MockScenario,
RequestMatcher,
MockResponse,
HttpMethod,
DevToolsState
} from '@sucoza/api-mock-interceptor-devtools-plugin';
git checkout -b feature/amazing-feature)git commit -m 'Add some amazing feature')git push origin feature/amazing-feature)MIT
Part of the @sucoza TanStack DevTools ecosystem.
FAQs
DevTools plugin for intercepting, mocking, and modifying API responses
We found that @sucoza/api-mock-interceptor-devtools-plugin demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.