
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
babel-plugin-test-export
Advanced tools
Export private variables and functions to your tests. Annotate variable and function declarations
with a // @test-export comment and they will be exported in a __test__ property of the module.
Use values exported like this to write more focused tests or to mock things.
$ yarn add --dev babel-plugin-test-export
Make sure to add this plugin only for tests. Example, in your .babelrc:
{
// ... your common configuration ...
env: {
test: {
plugins: [ "test-export" ]
}
}
}
mylib.js:
// @test-export
function appendFoo(str) {
return str + "foo"
}
module.exports = function (str) {
return appendFoo(str).toUpperCase()
}
mylibSpec.js (jasmine example):
const mylib = require("./mylib")
// Test private functions!
describe("appendFoo", () => {
const { appendFoo } = mylib.__test__
it("appends foo", () => {
expect(appendFoo("a")).toBe("afoo")
})
})
// Mock private functions!
describe("mylib", () => {
it("appends foo and turn value in uppercase", () => {
spyOn(mylib.__test__, "appendFoo")
expect(mylib("a")).toBe("AFOO")
expect(mylib.__test__.appendFoo).toHaveBeenCalled()
})
})
All references of the annotated variables and functions are rewritten to use the exported reference instead. The above example is rewritten as:
const __test__ = {};
// @test-export
__test__.appendFoo = function appendFoo(str) {
return str + "foo";
};
module.exports = function (str) {
return (void 0, __test__.appendFoo)(str).toUpperCase();
};
module.exports.__test__ = __test__
I used babel-strip-test-code as a start to write
this plugin. Its goal is quite similar: export private values via a export __test__ = { ... } and
it will strip this export for you in production. This approach, while quite simpler than mine,
is a bit more verbose and doesn't allow mocks.
FAQs
Export private variables and functions to your tests
We found that babel-plugin-test-export demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.