
Research
/Security News
5 Malicious Rust Crates Posed as Time Utilities to Exfiltrate .env Files
Published late February to early March 2026, these crates impersonate timeapi.io and POST .env secrets to a threat actor-controlled lookalike domain.
@tapjs/spawn
Advanced tools
@tapjs/spawnA default tap plugin providing t.spawn().
This plugin is installed with tap by default. If you had
previously removed it, you can tap plugin add @tapjs/spawn to
bring it back.
SpawnOptsOptions for t.spawn()
All of the normal Base and Extra options are also allowed.
cwd - string, the current working directory of the subprocessenv - Environment variables for the subprocess. Defaults to
process.envstdio - ChildProcess stdio option. Standard output is
always set to 'pipe', because that's how it communicates test
results, and file descriptor 3 is set to an IPC channel for
sending timeout signals.command (internal) - the command to run (set by first
argument to t.spawn)args (internal) - arguments to subprocess (set by second
argument to t.spawn)exitCode (internal) - Set on exit. The exit code of the
process, or null if terminated with a signal.signal (internal) - Set on exit. Terminating signal, or null
of not terminated with a signal.t.spawn(cmd, [args], [options], [name]): PromiseWithSpawnArguments:
cmd string - The command to runargs (optional) string | string[] - Arguments to pass to
the command.options (optional) SpawnOpts objectSpawns a process when the test starts, parsing its standard output as a TAP stream.
This is how the tap CLI runs test programs.
Returns a Promise that resolves when the test is complete. The
subtest member on the Promise is a
Spawn
instance.
FAQs
a built-in tap extension for t.spawn()
The npm package @tapjs/spawn receives a total of 147,165 weekly downloads. As such, @tapjs/spawn popularity was classified as popular.
We found that @tapjs/spawn demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Published late February to early March 2026, these crates impersonate timeapi.io and POST .env secrets to a threat actor-controlled lookalike domain.

Security News
A recent burst of security disclosures in the OpenClaw project is drawing attention to how vulnerability information flows across advisory and CVE systems.

Research
/Security News
Mixed-script homoglyphs and a lookalike domain mimic imToken’s import flow to capture mnemonics and private keys.