
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
danger-testing
Advanced tools
This project was created to allow a developer to test their DangerJS dangerfile through Jest unit testing.
It also works with testing imported DangerJS plugins.
:warning: This project is currently going through ramp up development.
Some things may change, some things may not work. Submit issues if you find any.
This package requires a minimum Danger and Jest version to function but it may function with future and previous versions as well. Create an issue/discussion if you test a version outside the required versions that you have found that works.
Until published install via direct GitHub link
$ npm install danger-testing --save-dev
This project assumes that Danger and Jest are already installed in your project.
Move dangerfile checks into a function or separate functions if you haven't done so previously.
// dangerfileFunctions.ts
// break your checks into functions that are exported.
// 📢 optionally, put all the functions inside a bigger function
// that's exported to test closer to how Danger would report.
export const checkLineAdditions = () => {
if (danger.github.pr.additions > 500) {
warn('PR exceeds number of lines added')
}
}
Create a test file like dangerfile.spec.ts to write your tests.
// dangerfile.spec.ts
import { dangerTesting, warn } from 'danger-js-testing'
import { checkLineAdditions } from '../dangerfile'
it('should call warn function if PR additions exceed 500 lines of code', async() => {
await dangerTesting(checkLineAdditions, {
github: {
pr: {
additions: 900,
},
},
})
expect(warn).toHaveBeenCalledWith(
'PR exceeds number of lines added'
)
expect(warn).toHaveBeenCalledTimes(1)
})
Takes inspiration from the documentation on the Danger website and myself wanting to have an easy way to test Danger during development.
The dangerTesting function accepts two arguments. One is the dangerfile function you have
written for your tests. The second is the mock override we attach to the global danger object.
When dangerTesting is called it updates the global mock and then calls the passed in function.
This module exports danger like global mock functions like fail, markdown, message, and warn,
to allow you to check that they are called as expected.
FAQs
Easy to use testing of DangerJS/dangerfile
We found that danger-testing demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.