Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@tapico/msw-webarchive
Advanced tools
An utility to drive requests handlers through a `.har` web-archive file
A utility to drive requests handlers through a .har
web-archive file for the
Mock Service Worker library. This utility allows you to mock server
handlers by using .har
web-archive file which can be created by using applications like Charles,
ProxyMan or the Chrome Developer Tools.
We have been using it during the development of web-applications, while the backend API endpoints weren't available yet or when we want to reproduce a problem of a customer. This way we can request the customer to send us a .har web-archive file and let this file drive the network requests to our back-end, this has greatly eased reproducing problems reported.
To use this library you need to have a HAR (*.har
) file generated from the network traffic of your
application. Follow the instructions below to learn how to do that.
npm install @tapico/msw-webarchive --save-dev
Follow the Installation instructions from the Mock Service Worker documentation.
import { setupWorker } from 'msw'
import { setRequestHandlersByWebarchive } from '@tapico/msw-webarchive'
import * as traffic from './example.har'
const worker = setupWorker()
setRequestHandlersByWebarchive(worker, traffic)
worker.start()
quiet: boolean
false
Disables the logging of debugging messages of the library.
setRequestHandlersByWebarchive(worker, har, {
quiet: true,
})
strictQueryString: boolean
true
Stricly match a request URL query parameters during request URL matching. When set to false
,
request URL query parameters are ignored during matching.
setRequestHandlersByWebarchive(worker, har, {
strictQueryString: false,
})
resolveCrossOrigins: (origin: string) => string
undefined
Override the Access-Control-Allow-Origin
response header whenever it's present.
setRequestHandlersByWebarchive(worker, har, {
resolveCrossOrigins(origin) {
return '*'
},
})
domainMappings: Record<string, string>
undefined
Allow mapping the domains in your har file to something else. This may be useful if you are making
relative requests against the origin (eg. fetch('/hello')
), you may want to use a domainMapping
configuration like:
setRequestHandlersByWebarchive(worker, har, {
domainMappings: {
'http://example.com': 'http://localhost',
},
})
responseDelay: 'real' | 'none' | ResponseDelayFunction
real
Controls the mock response delay behavior.
time
property in the HAR(timeDelay: number, requestContext: Request) => number
timeDelay
: the value of the time
property in the HAR, or 0 if there is no time
propertyrequestContext
: the request intercepted by Mock Service WorkersetRequestHandlersByWebarchive(worker, har, {
responseDelay: 'none'
})
setRequestHandlersByWebarchive(worker, har, {
responseDelay: (timeDelay: number, requestContext: Request) => {
if (requestContext.url === 'http://example.com') {
return timeDelay * 2
}
return 0
}
})
FAQs
An utility to drive requests handlers through a `.har` web-archive file
The npm package @tapico/msw-webarchive receives a total of 6,854 weekly downloads. As such, @tapico/msw-webarchive popularity was classified as popular.
We found that @tapico/msw-webarchive demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.