
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
andreyvit-gently
Advanced tools
A node.js module that helps with stubbing and behavior verification. It allows you to test the most remote and nested corners of your code while keeping being fully unobtrusive.
Via npm:
npm install gently@latest
Make sure your dog is working properly:
function Dog() {}
Dog.prototype.seeCat = function() {
this.bark('whuf, whuf');
this.run();
}
Dog.prototype.bark = function(bark) {
require('sys').puts(bark);
}
var gently = new (require('gently'))
, assert = require('assert')
, dog = new Dog();
gently.expect(dog, 'bark', function(bark) {
assert.equal(bark, 'whuf, whuf');
});
gently.expect(dog, 'run');
dog.seeCat();
You can also easily test event emitters with this, for example a simple sequence of 2 events emitted by fs.WriteStream
:
var gently = new (require('gently'))
, stream = new (require('fs').WriteStream)('my_file.txt');
gently.expect(stream, 'emit', function(event) {
assert.equal(event, 'open');
});
gently.expect(stream, 'emit', function(event) {
assert.equal(event, 'drain');
});
For a full read world example, check out this test case: test-incoming-form.js (in node-formdiable).
Creates a new gently instance. It listens to the process 'exit'
event to make sure all expectations have been verified.
Creates an expectation for an objects method to be called. You can optionally specify the call count
you are expecting, as well as stubFn
function that will run instead of the original function.
Returns a reference to the function that is getting overwritten.
Returns a function that is supposed to be executed count
times, delegating any calls to the provided stubFn
function. Naming your stubFn closure will help to properly diagnose errors that are being thrown:
childProcess.exec('ls', gently.expect(function lsCallback(code) {
assert.equal(0, code);
}));
Restores an object method that has been previously overwritten using gently.expect()
.
Returns a new require functions that catches a reference to all required modules into gently.hijacked
.
To use this function, include a line like this in your 'my-module.js'
.
if (global.GENTLY) require = GENTLY.hijack(require);
var sys = require('sys');
exports.hello = function() {
sys.log('world');
};
Now you can write a test for the module above:
var gently = global.GENTLY = new (require('gently'))
, myModule = require('./my-module');
gently.expect(gently.hijacked.sys, 'log', function(str) {
assert.equal(str, 'world');
});
myModule.hello();
Returns a stub class that will be used instead of the real class from the module at location
with the given exportsName
.
This allows to test an OOP version of the previous example, where 'my-module.js'
.
if (global.GENTLY) require = GENTLY.hijack(require);
var World = require('./world');
exports.hello = function() {
var world = new World();
world.hello();
}
And world.js
looks like this:
var sys = require('sys');
function World() {
}
module.exports = World;
World.prototype.hello = function() {
sys.log('world');
};
Testing 'my-module.js'
can now easily be accomplished:
var gently = global.GENTLY = new (require('gently'))
, WorldStub = gently.stub('./world')
, myModule = require('./my-module')
, WORLD;
gently.expect(WorldStub, 'new', function() {
WORLD = this;
});
gently.expect(WORLD, 'hello');
myModule.hello();
An object that holds the references to all hijacked modules.
Verifies that all expectations of this gently instance have been satisfied. If not called manually, this method is called when the process 'exit'
event is fired.
If msg
is given, it will appear in any error that might be thrown.
Gently is licensed under the MIT license.
FAQs
Unknown package
The npm package andreyvit-gently receives a total of 4 weekly downloads. As such, andreyvit-gently popularity was classified as not popular.
We found that andreyvit-gently demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.