
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
Cmdt is a command-line tool for testing command-line tools.
This is handy for testing a command line execution result by checking its exit code and output. Commands will be executed in a temporary directory /tmp/cmdt--/ , this directory will be removed after all tests are completed unless -d/--debug flag is specified.
npm install -g cmdt
Run tests on specified test files:
cmdt run <file1>.yml <file2>.yml
Run all test files contained in a directory:
cmdt run <dir>
Debug exit code and output of failing tests, temporary directory will be logged and won't be removed at the end of the execution:
cmdt run --debug <file>.yml <dir>
Set test command, expected exit code and/or output regular expression in a .yml file:
- description: should display user name
command: whoami
exitcode: 0
output: someuser
- command: time
exitcode: 0
output: real.+(\r\n?|\n)user.+
stdout: real.+(\r\n?|\n)user.+
- command: unknowncommand
exitcode: 1
stderr: ^some error$
Parameters can also be specified, and used in test command:
- params:
first_name: 'Theodore'
last_name: 'Twombly'
url: 'http://localhost'
- command: 'echo "Hey {first_name} {last_name}!"'
exitcode: 0
output: 'echo "Hey Theodore Twombly!"'
- command: 'wget {url}'
exitcode: 0
Environment variables are available as _env parameter in test commands:
NAME="Theodore Twombly" cmdt run <file>.yml <dir>
- command: 'echo "Hello {_env.NAME}!"'
exitcode: 0
output: 'echo "Hello Theodore Twombly!"'
Test fixtures files and directories can be specified in fixtures array, which will then be copied to test execution directory:
# assuming path/to/data_dir/foobar.txt and path/to/another_dir/barfoo.txt exist
- fixtures:
- path/to/data_dir
- path/to/another_dir/barfoo.txt
- command: 'file foobar.txt'
exitcode: 0
- command: 'file barfoo.txt'
exitcode: 0
| Name | Description | Mandatory |
|---|---|---|
| description | description of the test | No |
| command | command line to be executed | Yes |
| exitcode | expected exit code | No |
| output | stdout + stderr output, regexp matching | No |
| stdout | stdout only output, regexp matching | No |
| stderr | stderr only output, regexp matching | No |

Build reports:
FAQs
Command-line tool for testing command-line tools
We found that cmdt demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.