
Research
/Security News
5 Malicious Rust Crates Posed as Time Utilities to Exfiltrate .env Files
Published late February to early March 2026, these crates impersonate timeapi.io and POST .env secrets to a threat actor-controlled lookalike domain.
@tapjs/node-serialize
Advanced tools
A default tap plugin that serializes the output of root TAP
test for consumption by the node --test runner.
That is, this is for running tests that you write like:
import t from 'tap'
t.pass('this is fine')
// etc
and then run with node --test.
This plugin is installed with tap by default. If you had
previously removed it, you can tap plugin add @tapjs/node-serialize to bring it back.
When enabled, this plugin is activated when the
NODE_TEST_CONTEXT environment variable is set to child-v8.
When so activated, the root TAP test outputs a stream of
node:test message objects (ie, the data emitted by Node's
TestStream
class) to
standard output, instead of piping TAP data to standard output.
It has no effect on other tests within the suite.
To disable this behavior, run tap plugin rm @tapjs/node-serialize.
Node-tap and node's built-in node:test are not quite identical
in their approach.
Specifically, they have very different approaches to asynchronous
testing. When using node:test, all tests are placed in a queue,
and de-queued and started by level. It is considered an error for
a test to perform any asynchronous actions outside of the scope
of its parent suite method.
In tap, when t.jobs is set to some number greater than 1,
tests may run in any order, and their subtests may also run in
any order, at the same time as its siblings. While a subtest will
never start before its parent, it may start after its parent's
sibling tests, making the apparent nesting get interleaved in a
strictly event-stream based tracking.
To handle this, this serializer creates a tree of subtests, and
only emits the relevant node:test event messages all at once,
in the correct order that node --test expects.
The downside of this is that it may appear that tests hang and then emit all of their data at once. If true in-progress reporting is desired, then you're probably better off using tap's built-in test runner.
FAQs
Stream TAP test data as a serialized node:test stream
The npm package @tapjs/node-serialize receives a total of 182,957 weekly downloads. As such, @tapjs/node-serialize popularity was classified as popular.
We found that @tapjs/node-serialize demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Published late February to early March 2026, these crates impersonate timeapi.io and POST .env secrets to a threat actor-controlled lookalike domain.

Security News
A recent burst of security disclosures in the OpenClaw project is drawing attention to how vulnerability information flows across advisory and CVE systems.

Research
/Security News
Mixed-script homoglyphs and a lookalike domain mimic imToken’s import flow to capture mnemonics and private keys.