Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Fibble is a small library to insert test doubles into your test. It is heavily inspired by quibble but targeted at es modules only. It was also made to support pnpm which creates a slightly different layout in the node_modules folder than other package managers and is thus built independent of resolution algorithm.
There are two functions exported from fibble:
replace(path, replacement)
- Replaces the module at path
with the replacement.
path
(string) - A path to the module to replace. The path should be relative from the file you are calling replace
in.replacement
(object) - The object to replace the replacement to do. The
object should contain key that you import
in the file you want to test.
If you want to stub the default export, name a key default
.await
its' completion.reset()
- Removes all registered replacements. All imports
made after this call will use their native dependencies.
There are two modes available depending on the version of node you run. This is because node has changed their API for loaders.
Use this with node version 18.19.0
and above.
node --experimental-import-meta-resolve --import fibble/register [my app]
Use this with node version 18.18.x
and below.
node --experimental-import-meta-resolve --loader fibble/loader [my app]
Fibble does not support node version 20.0.0
- 20.5.x
.
This example uses mocha/chai but feel free to use in your favorite test runner.
import { describe, beforeEach, it } from 'mocha'
import { expect } from 'chai'
import { replace, reset } from 'fibble'
describe('my module', function(){
let subject
beforeEach(async () => {
await replace ('./path/to/module/to/replace.js', { someProperty: 'some replacement value' })
subject = await import('./module-to-test.js').default // or the property you want to test
})
afterEach(reset) // clear all replacements
it('contains the stubbed stuff', function() {
expect(subject(), ...) // to work with the replacemed module
})
})
Setup mocha like this:
// .mocharc.cjs
module.exports = {
'node-option': ['experimental-import-meta-resolve', 'import=fibble/register'],
}
FAQs
Small library to insert test doubles into your tests
The npm package fibble receives a total of 24 weekly downloads. As such, fibble popularity was classified as not popular.
We found that fibble demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.