Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
cypress-mailisk
Advanced tools
npm install --save-dev cypress-mailisk
yarn add cypress-mailisk --dev
After installing the package add the following in your project's cypress/support/e2e.js
:
import 'cypress-mailisk';
To be able to use the API you will need to add your API key to cypress.config.js
:
module.exports = defineConfig({
env: {
MAILISK_API_KEY: 'YOUR_API_KEY',
},
});
The cypress-mailisk plugin provides additional commands which can be accessed on the cypress object, for example cy.mailiskSearchInbox()
. These commands extend the Chainable object which allows you to use the then()
method to chain commands.
This is the main command to interact with Mailisk, it wraps the Search Inbox endpoint.
cy.mailiskSearchInbox('yournamespace', { to_addr_prefix: 'test.user@' }).then((response) => {
const emails = response.data;
// ...
});
This Cypress command does a few extra things out of the box compared to calling the raw API directly:
wait
flag. This means the call won't return until at least one email is received. Disabling this flag via wait: false
can cause it to return an empty response immediately.timeout
in the request options. By default it uses a timeout of 5 minutes.from_timestamp
parameter (from_timestamp: 0
will disable filtering by email age).// timeout of 5 minute
cy.mailiskSearchInbox(namespace);
// timeout of 1 minute
cy.mailiskSearchInbox(namespace, {}, { timeout: 1000 * 60 });
// returns immediately, even if the result would be empty
cy.mailiskSearchInbox(namespace, { wait: false });
For the full list of filters and their description see the Search Inbox endpoint reference.
The to_addr_prefix
option allows filtering by the email's TO address. Specifically the TO address has to start with this.
For example, if someone sends an email to my-user-1@yournamespace.mailisk.net
, you can filter it by using my-user-1@
:
cy.mailiskSearchInbox(namespace, {
to_addr_prefix: 'my-user-1@',
});
The from_addr_includes
option allows filtering by the email's FROM address. Specifically the TO address has to include this. Note that this is different from the to address as it is includes not prefix.
For example, if someone sends an email from the example.com
domain we could filter like so:
cy.mailiskSearchInbox(namespace, {
from_addr_includes: '@example.com',
});
If we know a specific email address we want to listen to we can do this:
cy.mailiskSearchInbox(namespace, {
from_addr_includes: 'no-reply@example.com',
});
The subject_includes
option allows filtering by the email's Subject. Specifically the Subject has to include this (case-insensitive).
If we're testing password reset that sends an email with the subject Password reset request
. We could filter by something like this:
cy.mailiskSearchInbox(namespace, {
subject_includes: 'password reset request',
});
This example demonstrates going to a password reset page, requesting a new password, receiving reset code link via email and finally setting the new password.
describe('Test password reset', () => {
let resetLink;
const namespace = 'yournamespace';
const testEmailAddr = `test.test@${namespace}.mailisk.net`;
it('Starts a password reset', () => {
cy.visit('https://example.com/password_reset');
cy.get('#email_field').type(testEmailAddr);
});
it('Gets a password reset email', () => {
cy.mailiskSearchInbox(namespace, {
to_addr_prefix: testEmailAddr,
subject_includes: 'password',
}).then((response) => {
expect(response.data).to.not.be.empty;
const email = response.data[0];
expect(email.subject).to.equal('Please reset your password');
resetLink = email.text.match(/.(https:\/\/example.com\/password_reset\/.*)>\n*/)[1];
expect(resetLink).to.not.be.undefined;
});
});
it('Goes to password reset link', () => {
cy.visit(resetLink);
cy.title().should('contain', 'Change your password');
cy.get('#password').type('MyNewPassword');
cy.get('#password_confirmation').type('MyNewPassword');
cy.get('form').submit();
});
});
See the full Mailisk Documentation for more examples and information.
FAQs
Mailisk library for Cypress
The npm package cypress-mailisk receives a total of 14,705 weekly downloads. As such, cypress-mailisk popularity was classified as popular.
We found that cypress-mailisk demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.