
Research
/Security News
5 Malicious Rust Crates Posed as Time Utilities to Exfiltrate .env Files
Published late February to early March 2026, these crates impersonate timeapi.io and POST .env secrets to a threat actor-controlled lookalike domain.
@tapjs/fixture
Advanced tools
@tapjs/fixtureA default tap plugin providing t.testdir() and t.fixture()
methods, for creating temporary directories with stuff for tests
to operate on.
Fixtures created with this plugin live folders under
./.tap/fixtures, in the root of the project. The folder name is
based on the name of the test file, and the name of the test.
For example, if a file at ./src/foo.test.mjs had this:
import t from 'tap'
t.test('child test', async t => {
t.testdir({ file: 'contents' })
})
Then a file would be created at
.tap/fixtures/src-foo.test.mjs-child-test/file containing
'contents'.
This plugin is installed with tap by default. If you had
previously removed it, you can tap plugin add @tapjs/fixture to
bring it back.
t.testdir(contents?: FixtureDirContent): stringCreate a directory with some stuff in it.
If no contents provided, just creates an empty directory.
import t from 'tap'
import { lstatSync } from 'node:fs'
t.test('subtest that has a test directory', t => {
const dir = t.testdir({
// objects are subdirectories
subdir: {
// strings or buffers are files
'file.txt': 'some contents',
// to create links or symlinks, use the t.fixture() method
symlink: t.fixture('symlink', 'file.txt'),
hardlink: t.fixture('link', 'file.txt'),
},
})
t.equal(lstatSync(dir + '/subdir/symlink').isSymbolicLink(), true)
t.end()
})
// dir removed when test ends
If you do not provide a contents argument, then it will create an empty directory.
Though it's called t.testdir() you can actually use it to
create files or links as well.
import t from 'tap'
import { readFileSync } from 'node:fs'
t.test('test "dir" is actually file', t => {
const file = t.testdir('file contents')
t.equal(readFileSync(file, 'utf8'), 'file contents')
t.end()
})
t.testdirName: stringThis is a string that gives you the string path that
t.testdir() will write to.
saveFixture test option, t.saveFixture: booleanIf set to true, then the test will not delete its fixtures when
it finishes.
If set on the test object, this must be set before calling
t.testdir(), or it won't have any effect, since the deletion is
scheduled at the moment it's created.
FAQs
Tap plugin to provide t.testdir() and t.fixture()
The npm package @tapjs/fixture receives a total of 147,276 weekly downloads. As such, @tapjs/fixture popularity was classified as popular.
We found that @tapjs/fixture demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Published late February to early March 2026, these crates impersonate timeapi.io and POST .env secrets to a threat actor-controlled lookalike domain.

Security News
A recent burst of security disclosures in the OpenClaw project is drawing attention to how vulnerability information flows across advisory and CVE systems.

Research
/Security News
Mixed-script homoglyphs and a lookalike domain mimic imToken’s import flow to capture mnemonics and private keys.