
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

This is a library to the code that is easy to test the code hard to test.
It is also possible to secretly substitute to mock a module code under test calls as brood parasitism of the cuckoo.
In addition, cuckoo can change untestable code (the local function and local variables that are not exported to the outside) to testable.
install cuckoo via npm first:
npm install cuckoo
and then include it in your project with:
var cuckoo = require('cuckoo');
target.js
var util = require('util')
;
function untestableMethod() {
util.isArray([1, 2, 3]);
}
exports.testableMethod = function () {
return 1;
};
target-test.js
var cuckoo = require('cuckoo')
, assert = require('assert')
, path = require('path')
;
describe('#untestableMethod', function () {
it('should have set the array to util#isArray', function () {
var target
, mock = {}
, filePath = path.resolve(__dirname, './target.js'); //filePath must be absolute
;
mock.util = {
isArray: function (ary) {
assert.deepEqual([1, 2, 3], ary); // pass
}
};
target = cuckoo.load(filePath, mock);
target.private.untestableMethod();
});
});
describe('#testableMethod', function () {
it('should get 1', function () {
var filePath = path.resolve(__dirname, './target.js');
, target = cuckoo.load(filePath)
;
assert.equal(1, target.public.testableMethod());
});
});
###cuckoo#load(filePath, [mocks])
@param String filePath File path of the test target (must be absolute)
@param Object [mocks] replace mock when the require is called
@return Object
{
context: "Variable object under test",
private: "Variable object under test",
public: "Public methods of test",
module: "Module object under test"
}
MIT
FAQs
This is a library to the code that is easy to test the code hard to test.
We found that cuckoo demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.