
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
assistive-playwright-client
Advanced tools
assistive-playwright-client is a library that extends playwright to allow end-to-end testing of web applications with a screen reader. It is designed to connect to the assistive-playwright-server component that runs inside a virtual machine that is cloned
This package contains a node.js library that extends playwright to allow end-to-end testing of web applications with a screen reader (such as NVDA or JAWS) and checking that the screen reader says what is expected.
This requires two main features that are not natively supported by playwright:
So, assistive-playwright-client allows to easily clone and start a virtual machine (with the vm-providers component) and it provides access to the following functions (through the assistive-playwright-server component that is supposed to be running inside the virtual machine):
Here is a schema describing the architecture of Assistive-Playwright:

Make sure you have the following software installed on the host machine:
Make sure you have a VirtualBox or QEMU virtual machine properly configured. To configure the virtual machine, you can follow this step-by-step guide. The virtual machine should be configured with:
Install assistive-playwright-client in your project:
npm install assistive-playwright-client
vboxwebsrv in order to be able to start virtual machines of type virtualbox:vboxwebsrv --authentication null
gettingStarted.js file that shows how to use assistive-playwright-client:const { createVM } = require("assistive-playwright-client");
(async () => {
console.log("Creating VM...");
const {
chromium /* can be replaced with firefox or webkit */,
screenReader,
calibrateMouse,
keyboard,
vm
} = await createVM({
vmSettings: {
type: "virtualbox",
vm: "win10-chromium-nvda",
snapshot: "nvda"
}
});
try {
console.log("Launching browser...");
const browser = await chromium.launch({ headless: false });
const page = await browser.newPage({ viewport: null });
const mouse = await calibrateMouse(page);
screenReader.on("message", msg => console.log(`sr> ${msg}`));
await page.goto("https://duckduckgo.com/");
await mouse.click(0, 0, { origin: await page.$("input[type=text]") });
await screenReader.waitForMessage("Search the web");
await keyboard.type("assistive-playwright-client");
await keyboard.press("Enter");
await screenReader.waitForMessage(
"assistive playwright client at Duck Duck Go"
);
await keyboard.press("Tab");
await screenReader.waitForMessage("edit");
} finally {
console.log("Destroying VM...");
await vm.destroy();
console.log("Done!");
}
})().catch(error => {
console.log(`Error: ${error}`);
process.exit(1);
});
The API documentation is available here
Note that in order to run tests with a screen reader, instead of directly depending on this package, it is easier and recommended to use the assistive-playwright-test package along with @playwright/test.
FAQs
assistive-playwright-client is a library that extends playwright to allow end-to-end testing of web applications with a screen reader. It is designed to connect to the assistive-playwright-server component that runs inside a virtual machine that is cloned
The npm package assistive-playwright-client receives a total of 2 weekly downloads. As such, assistive-playwright-client popularity was classified as not popular.
We found that assistive-playwright-client demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.