Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
abstract-npm-registry
Advanced tools
An open and extendible test suite for you can use to test various functional areas of an npm registry.
An open and extendible test suite for you can use to test various functional areas of an npm registry.
Understanding the wire protocol expected by the npm CLI is incredibly important. Without a thorough, accurate, and open representation of this HTTP-based API a number of important scenarios to the success of the Node.js ecosystem are largely impossible and definitely improbable:
npm
(e.g. a remote npm
post-publish hook similar to a git
post-commit hook).This project is an attempt to document the public npm
wire protocol for these reasons and more by creating an open and extendible test suite for anyone to use and contribute to. It pulls data from multiple sources:
url.resolve
represent one or more routes that Client
instances consume when used by the npm
CLI.The goal of this project is to have 100% coverage over all routes and important usage scenarios (e.g. attempting to publish a package that is not yours). We cannot do this without YOUR HELP!
abstract-npm-registry
uses mocha
and assume
for test execution and assertion. Most common configurations can be accomplished by using the micro-runner provided by abstract-npm-registry
.
const abstractNpmRegistry = require('abstract-npm-registry');
//
// Runs the entire suite of tests
//
abstractNpmRegistry({
registry: 'https://registry.npmjs.org',
headers: {
'X-ANY-HEADER-YOU-WANT': true
},
//
// By default all of these suites are
// included.
//
suites: [
'publish',
'unpublish'
]
});
n.b. By default all test suites are included
suites: [
'pkg/show',
'pkg/fetch',
'publish',
'unpublish',
'pkg/dist-tag',
'user/add',
'user/logout',
'pkg/update',
'ping',
'whoami',
'team',
'access',
'views/all',
'views/query'
]
Want more options or more granular options? Use abstract-npm-registry
with mocha
directly (see below) or open an issue!.
mocha
directlyEach named export on any require
able "suite" exposed by abstract-npm-registry
is simply a function that returns an it
function. The returned function can be passed to it
in any mocha
suite. e.g.
my.custom.test.js
const abstractNpmRegistry = require('../')({
registry: 'https://registry.npmjs.org',
headers: { 'X-ANY-HEADER-YOU-WANT': true }
});
console.log('\n\n> Starting my custom test suite using mocha...');
describe('My super custom test suite', function () {
abstractNpmRegistry.it('pkg/dist-tag.add');
abstractNpmRegistry.it('pkg/dist-tag.list');
abstractNpmRegistry.it('pkg/dist-tag.remove');
abstractNpmRegistry.it('pkg/fetch.found');
abstractNpmRegistry.it('pkg/fetch.noVersion');
abstractNpmRegistry.it('pkg/fetch.noPackage');
});
FAQs
An open and extendible test suite for you can use to test various functional areas of an npm registry.
We found that abstract-npm-registry demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.