
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
cypress-flaky-test-audit
Advanced tools
Cypress plugin for deep per-command insights, including queue order, execution timing, and visual HTML reports.
A Cypress plugin that tracks the order in which Cypress commands are entered into the command queue and delivers detailed, per-command analytics for your test runs, including execution order, timing, retries, and pass/fail outcomes.
It helps identify flaky tests, performance bottlenecks, and commands that don’t execute, and presents audit results in the browser console, terminal output, and an HTML report with visual graphs of Cypress command execution across your test suite.

Related reading: The async nature of Cypress – don’t mess with the timelines in your Cypress tests (dual verse)
✔️ Command Queue Tracing – Captures enqueue order, runnable type, nested relationships, and execution transitions for every Cypress command and assertion.
✔️ Retry-aware Test Timeline – Stores metadata for each test attempt (start time, duration, retry index, pass/fail state) so you can compare executions side-by-side.
✔️ Multiple Output Channels – Choose between browser console, terminal console, and a shareable HTML report enriched with network-style graphs.
✔️ Slowness Thresholds – Highlight slow tests and commands with customizable performance budgets.
✔️ Richer Failure Context – Failed command tooltips now surface both the code frame (file:line:column) and the underlying error message so you can jump straight to the root cause.
✔️ Dual Graph Views – Toggle between Execution path (actual run order) and Queue path (enqueue order) directly in the report; queue edges render as dotted lines for clarity.
✔️ Task-free HTML Export – When enabled, automatically writes a timestamped HTML file per spec under cypress/reports/flaky-test-audit/, including:
✔️ Minimal setup – a single import in cypress/support/e2e.js plus one helper in cypress.config.js.
^15.7.0. The plugin relies on modern event hooks and events (test:before:run, command lifecycle events), so Cypress 13+ is recommended.npm install --save-dev cypress-flaky-test-audit
Register the plugin tasks and the audit report folder inside cypress.config.js (or cypress.config.ts):
const addFlakyTestAuditTasks = require('cypress-flaky-test-audit/src/tasks');
module.exports = {
testAuditFolder: 'cypress/reports/flaky-test-audit/',
// ... rest of config parameters
e2e: {
setupNodeEvents(on, config) {
addFlakyTestAuditTasks(on);
// .. rest of etupNodeEvents consig
return config;
},
// ...rest of your e2e config
},
};
Enable the audit at runtime by importing the main hook file at the very beginning of your cypress/support/e2e.js file (this will ensure you do not leave out any beforeEach and afterEach hooks from the test audit for the suite):
import 'cypress-flaky-test-audit';
Toggle the feature using Cypress environment variables (see Configuration).
Set these keys via cypress.config.{js,ts} (as a property in the module.exports, or in the e2e object).
| Config var | Type | Default | Description |
|---|---|---|---|
testAuditFolder (Cypress config key) | string | cypress/reports/flaky-test-audit/ | Destination for generated HTML files. |
Example cypress.config.js:
module.exports = {
testAuditFolder: 'cypress/reports/flaky-test-audit/',
e2e: {
setupNodeEvents(on, config) {
// ...
},
},
};
Set these keys via cypress.config.{js,ts} (env object), cypress.env.json, or CLI --env flags.
| Env var | Type | Default | Description |
|---|---|---|---|
enableFlakyTestAudit | boolean | false | Master switch. When disabled, no listeners are registered. |
flakyTestAuditConsoleType | "list" | "table" | table | Choose how results are printed in the browser and terminal consoles. |
testSlownessThreshold | number (ms) | 5000 | Duration above which a test is marked as slow. |
commandSlownessThreshold | number (ms) | 1500 | Duration above which a command row is annotated as slow. |
createFlakyTestAuditReport | boolean | false | Enable HTML report generation after the suite finishes. |
testAuditFolder | string | cypress/reports/flaky-test-audit/ | Destination for generated HTML files. |
Example cypress.env.json:
{
"enableFlakyTestAudit": true,
"createFlakyTestAuditReport": true,
"flakyTestAuditConsoleType": "table",
"testSlownessThreshold": 8000,
"commandSlownessThreshold": 2000
}
Depending on which outputs you enable, the audit data is presented in three different ways: browser console, terminal console, HTML report.
Styled tables or lists (based on the flakyTestAuditConsoleType environment variable) rendered directly in the Cypress runner DevTools.
Great for debugging locally without leaving the browser.
Output:
At the Test level, it shows a summary of that test retry:
✔️ PASSED✔️ PASSED (⏳ *slow*) (duration longer than testSlownessThreshold)❌ FAILED⛔ QUEUED (*never run*).Also, for each Cypress command in that test retry:
State: Whether the command executed successfully or not.
✔️ PASSED: The command ran successfully.✔️ PASSED (⏳ *slow*): The command passed but was slower than the threshold set by the commandSlownessThreshold environment variable.❌ FAILED: The command caused the test to fail.⛔ QUEUED (*never run*): The command was added to the Cypress queue but never run.Runnable type: Where the command ran: in a hook (before, before each, after each) or in the main test body.
Type: The nature of the Cypress command (Query, Parent command, Child command, or Dual Command).
Command: The command being executed with its call arguments (e.g., VISIT ('https://automationintesting.online/')).
Enqueued order: The order in which the command is added to the Cypress queue.
Enqueued time: Exact time when the command was inserted into the Cypress queue (to millisecond precision).
Execution order: The order in which the command is executed from the Cypress queue.
Start time: Exact time when the command was taken from the Cypress queue and started executing (to millisecond precision).
Run time: Time the command took to run, or time elapsed until the command failed (to millisecond precision).
#Internal retries: Number of retries performed by Cypress’s internal retry mechanism until the command succeeds or fails.
Test failed in retry #0.

Test Passed in retry #1, but the overall execution was slow (more than testSlownessThreshold).

cy.task handlers (see cypress-flaky-test-audit/src/tasks.js).Test Passed in retry #1, but the overall execution was slow (more than testSlownessThreshold).

Test Failed in retry #0.

Each report contains:
Suite overview with total tests, failures, suite run duration, and metadata.
Individual test cards summarizing test title, total duration, and test status (passed/failed).
For each retry in a test:
vis-network) that visualizes the execution timeline, nested executions, and state transitions.HTML report is written automatically when createFlakyTestAuditReport is true.
Files are saved as <spec-name>_<timestamp>.html in the folder specified by the Cypress config variable testAuditFolder (by default, this is cypress/reports/flaky-test-audit/).
You can download the latest example HTML report (showing Execution vs Queue paths and enriched failure tooltips) from
assets/flaky-demo.html.
This is an overview of a Flaky Test Audit report, showing the suite header with metadata, the list of tests, and each retry that was run for every test.

The interactive command graph is designed to help you read a test run at a glance: what happened, what failed, what never ran, and where time was spent.
.should()) show up as circles (dots), so they’re easy to spot in the flow.commandSlownessThresholdCommands, queries, and assertions that belong to the same block scope are shown as nested in the graph (indented).
Cypress commands that run inside hooks (before, beforeEach(), or afterEach()) use the same color rules as commands in the test body, but are shown with a faded appearance to distinguish them from the main test commands.
In the graph, each hook and the test body are placed in separate sections, divided by dotted lines and labeled, making it easy to tell them apart.
For example, given this Cypress test code:

The graph below shows the exact order in which commands were executed, how long each took, and what their final state was after execution:

The execution path shows that just after the then() command, wait() is enqueued, but get() runs first because it's inside the then() block scope.
⚠️ IMPORTANT CONSIDERATIONS ABOUT HOW HOOKS ARE SHOWN IN THE TEST AUDIT PLUGIN
Audit data for each test retry is recorded using an
afterEach()hook, imported at the top of youre2e.jsfile (byimport 'cypress-flaky-test-audit'). The HTML audit report for the entire suite is generated in anafter()hook it is also defined in that same import.This means that, depending on which block scope your hooks are defined in your suite file and how Cypress determines hook order, hooks may or may not appear in the test audit reports (both in the console and in the graphs):
before()hooks defined in your suite will always be shown for retry #0 of the suite's first test.after()hooks defined in your suite will never be shown in the results.beforeEach()andafterEach()hooks defined inside a block scope (like within adescribe()orcontext()) will always be shown in the results.beforeEach()andafterEach()hooks defined at the root level of your file (not wrapped bydescribe()orcontext()) will never be shown in the results.
For each retry executed, there are 2 visualizations of the test run: Execution path and Queued path.
Execution paths are represented with solid arrows in the graph, and enqueued paths with dotted arrows.
These two orders are not always the same. Because Cypress commands are queued asynchronously, commands can be added from inside other command block scopes (for example within a .then() callback) or from within a custom command implementation. In those cases, Cypress may enqueue some commands later, even though they execute as part of the same overall flow, so the execution order and enqueued order can diverge.
To help you see the difference between executed and enqueued commands, the Execution Path graph includes a toggle called # SHOW QUEUE ORDER. Turning this on or off will show or hide a label next to each command or assertion, indicating the position at which it was added to the Cypress command queue.


Each node in the graph is clickable. When you click a command, query, or assertion, the report opens a tooltip with the most relevant execution details for that node.
How to open/close
Tooltip fields (always shown)
visit, get, should).✔️ passed❌ failed⛔ queued (never run) (when it was enqueued but never executed)⏳ passed (slow) (when it passed, but took longer than your commandSlownessThreshold)test) or inside a hook (beforeEach, afterEach).Extra fields (only when the node failed)
file:line:column.Box width (rectangles)





Released under the MIT License.
Contributions are welcome! If you find a bug or want to propose an improvement:
git checkout -b feat/my-improvement.FAQs
Cypress plugin for deep per-command insights, including queue order, execution timing, and visual HTML reports.
We found that cypress-flaky-test-audit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.