Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
babel-plugin-istanbul
Advanced tools
A babel plugin that adds istanbul instrumentation to ES6 code
The babel-plugin-istanbul npm package is used to instrument your JavaScript code with Istanbul coverage. It works seamlessly with Babel and test runners like Mocha, Jest, and others to generate coverage reports. This plugin is typically used during testing to collect information about which parts of your codebase are covered by tests.
Code Instrumentation
This feature automatically instruments your code with Istanbul coverage when it is being transpiled by Babel. The code sample shows how to apply the plugin when transforming code with Babel.
require('babel-core').transform('code', { plugins: ['istanbul'] });
Coverage Reporting
After running tests with the instrumented code, you can generate coverage reports in various formats using Istanbul's command line tool, nyc. The code sample shows how to generate a text report.
nyc report --reporter=text
Configuration Options
The plugin allows you to specify options such as excluding files or directories from being instrumented. The code sample demonstrates how to exclude all files in the 'test' directory.
{ 'plugins': [['istanbul', { 'exclude': ['test/**/*.js'] }]] }
nyc is Istanbul's command line interface and can be used for instrumenting code, running tests, and generating coverage reports. It works well with subprocesses and can be used as a standalone tool without Babel.
istanbul is the original code coverage tool that provides a JavaScript API for instrumenting code, as well as a command line tool for generating reports. It is the underlying tool that babel-plugin-istanbul and nyc are built upon.
Jest is a testing framework that includes its own coverage reporting capabilities. It uses Istanbul under the hood for coverage instrumentation and can generate coverage reports without the need for additional plugins.
karma-coverage is a plugin for the Karma test runner that generates code coverage reports using Istanbul. It is similar to babel-plugin-istanbul but is specifically designed to work within the Karma ecosystem.
Having problems? want to contribute? join our community slack.
A Babel plugin that instruments your code with Istanbul coverage. It can instantly be used with karma-coverage and mocha on Node.js (through nyc).
Note: This plugin does not generate any report or save any data to any file; it only adds instrumenting code to your JavaScript source code. To integrate with testing tools, please see the Integrations section.
Install it:
npm install --save-dev babel-plugin-istanbul
Add it to .babelrc
in test mode:
{
"env": {
"test": {
"plugins": [ "istanbul" ]
}
}
}
Optionally, use cross-env to set
NODE_ENV=test
:
{
"scripts": {
"test": "cross-env NODE_ENV=test nyc --reporter=lcov --reporter=text mocha test/*.js"
}
}
It just works with Karma. First, make sure that the code is already transpiled by Babel (either using karma-babel-preprocessor
, karma-webpack
, or karma-browserify
). Then, simply set up karma-coverage according to the docs, but don’t add the coverage
preprocessor. This plugin has already instrumented your code, and Karma should pick it up automatically.
It has been tested with bemusic/bemuse project, which contains ~2400 statements.
Configure Mocha to transpile JavaScript code using Babel, then you can run your tests with nyc
, which will collect all the coverage report.
babel-plugin-istanbul respects the include
/exclude
configuration options from nyc,
but you also need to configure NYC not to instrument your code by adding these settings in your package.json
:
"nyc": {
"sourceMap": false,
"instrument": false
},
You don't want to cover your test files as this will skew your coverage results. You can configure this by providing plugin options matching nyc's exclude
/include
rules:
{
"env": {
"test": {
"plugins": [
["istanbul", {
"exclude": [
"**/*.spec.js"
]
}]
]
}
}
}
If you don't provide options in your Babel config, the plugin will look for exclude
/include
config under an "nyc"
key in package.json
.
You can also use istanbul's ignore hints to specify specific lines of code to skip instrumenting.
By default, this plugin will pick up inline source maps and attach them to the instrumented code such that code coverage can be remapped back to the original source, even for multi-step build processes. This can be memory intensive. Set useInlineSourceMaps
to prevent this behavior.
{
"env": {
"test": {
"plugins": [
["istanbul", {
"useInlineSourceMaps": false
}]
]
}
}
}
If you're instrumenting code programatically, you can pass a source map explicitly.
import babelPluginIstanbul from 'babel-plugin-istanbul';
function instrument(sourceCode, sourceMap, filename) {
return babel.transform(sourceCode, {
filename,
plugins: [
[babelPluginIstanbul, {
inputSourceMap: sourceMap
}]
]
})
}
The approach used in babel-plugin-istanbul
was inspired by Thai Pangsakulyanont's original library babel-plugin-__coverage__
.
babel-plugin-istanbul
for enterpriseAvailable as part of the Tidelift Subscription.
The maintainers of babel-plugin-istanbul
and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source dependencies you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact dependencies you use. Learn more.
FAQs
A babel plugin that adds istanbul instrumentation to ES6 code
We found that babel-plugin-istanbul demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.