
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@sucoza/stress-testing-devtools-plugin
Advanced tools
TanStack DevTools plugin for API stress testing and performance monitoring
A comprehensive TanStack DevTools plugin that allows you to perform load testing on your APIs directly from the browser developer tools. Easily import requests from browser Network tabs, cURL commands, and other formats.
{{tenantId}} and {{regionId}}npm install @sucoza/stress-testing-devtools-plugin
The easiest way to get started is to import a request from your browser's Network tab:
Supported formats:
Before running a stress test, verify your request works:
Choose your testing approach:
Fixed Count Test:
Timed Rate Test:
Monitor real-time metrics:
import { createStressTestPlugin } from '@sucoza/stress-testing-devtools-plugin'
// Create the plugin with default configuration
const stressTestPlugin = createStressTestPlugin()
// Add to your TanStack DevTools configuration
import { TanStackDevtools } from '@tanstack/devtools'
const devtools = new TanStackDevtools({
plugins: [stressTestPlugin]
})
import { createStressTestPlugin } from '@sucoza/stress-testing-devtools-plugin'
const stressTestPlugin = createStressTestPlugin({
initialConfigs: [
{
name: 'User Info',
method: 'GET',
path: '/api/users/me',
inputParams: {},
test: 'response.id !== undefined'
},
{
name: 'Search Users',
method: 'POST',
path: '/api/users/search',
inputParams: {
tenantId: '{{tenantId}}',
query: 'test'
},
test: 'response.users && response.users.length >= 0'
}
]
})
Each request configuration follows this structure:
interface StressTestConfig {
name: string // Display name for the request
method: 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH'
path: string // API endpoint path
inputParams: Record<string, any> // Request body/parameters
test: string // JavaScript expression to validate response
headers?: Record<string, string> // Optional additional headers
}
The test field should contain a JavaScript expression that evaluates to true for a successful response:
// Examples:
"response.length > 0"
"response.data !== undefined"
"response.users && response.users.length >= 0"
"response.success === true"
Use these tokens in your inputParams and they will be automatically replaced:
{{tenantId}} - Current user's tenant ID{{regionId}} - Current user's region IDExample:
{
"inputParams": {
"tenantId": "{{tenantId}}",
"regionId": "{{regionId}}"
}
}
The plugin includes a powerful validation engine that goes far beyond simple response checks:
// Check for successful status codes
{
"type": "status",
"operator": "equals",
"expectedValue": 200
}
// Ensure not error codes
{
"type": "status",
"operator": "lessThan",
"expectedValue": 400
}
// Check content type
{
"type": "header",
"target": "content-type",
"operator": "contains",
"expectedValue": "application/json"
}
// Ensure security headers exist
{
"type": "header",
"target": "x-frame-options",
"operator": "exists"
}
// JSONPath validation
{
"type": "body",
"operator": "jsonPath",
"target": "data.users[0].id",
"expectedValue": 12345
}
// Content validation
{
"type": "body",
"operator": "contains",
"expectedValue": "success"
}
// Response time limits
{
"type": "responseTime",
"operator": "lessThan",
"expectedValue": 500
}
// Response size checks
{
"type": "size",
"operator": "greaterThan",
"expectedValue": 100
}
Write custom JavaScript validation logic:
{
"type": "custom",
"operator": "custom",
"customCode": `
// Full access to response, status, headers, responseTime, responseSize
if (response.data && Array.isArray(response.data.users)) {
return response.data.users.length > 0;
}
return false;
`
}
The ✨ Generate Rules feature automatically creates validation rules based on your test response:
These generated rules can be customized, enabled/disabled, or used as templates for more complex validation.
The plugin provides comprehensive metrics for each test run:
The plugin automatically handles authentication by:
localStorage.getItem('jwtToken')XSRF-TOKEN-WEBAPI){{tenantId}} and {{regionId}} tokens# Install dependencies
npm install
# Build the plugin
npm run build
# Development mode with watch
npm run dev
# Type checking
npm run type-check
See the example/ directory for a complete working example of the plugin in action.
| Feature | Original Bookmarklet | New DevTools Plugin |
|---|---|---|
| UI/UX | Basic HTML popup | Professional React interface |
| Request Import | Manual JSON editing | Import from Network tab, cURL, fetch, etc. |
| Validation | Simple JavaScript expressions | Advanced validation engine with multiple rule types |
| Configuration | Hard-coded JSON in popup | Visual editor + JSON editor with validation |
| Test Single Requests | No single request testing | Test & examine responses before stress testing |
| Rule Generation | Manual rule writing | Auto-generate validation rules from responses |
| State Management | Global variables | Centralized store with persistence |
| Test History | None | Full history with detailed metrics |
| Error Analysis | Basic error counting | Detailed error categorization and reporting |
| Metrics | Basic P50/P90/P95 stats | Comprehensive performance metrics with real-time updates |
| Integration | Standalone bookmarklet | Integrated TanStack DevTools plugin |
| Type Safety | Plain JavaScript | Full TypeScript support |
| Authentication | Manual token handling | Automatic JWT/XSRF extraction |
| Export/Import | Copy-paste JSON | Clipboard integration + visual import/export |
MIT
Part of the @sucoza TanStack DevTools ecosystem.
Contributions are welcome! Please feel free to submit a Pull Request.
FAQs
TanStack DevTools plugin for API stress testing and performance monitoring
We found that @sucoza/stress-testing-devtools-plugin demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.