
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
Do you like keeping your unit tests close to your code, with as little fanfare as possible? Does it annoy you to export things just to be able to test them? Inspired by rust's cargo, I want to write unit tests in the same file as the code they test. With this tool, you write the following in any module of your project:
export default class SomeClass {
}
export function tests() {
return {
test_a(assert) {
assert(new SomeClass().a, undefined);
}
}
}
A test function receives the nodejs assert module so you don't need to import it.
After installing with npm install --global impunity, you run the tests with impunity --entry-point your/main.js (use --force-esm-dirs src/ if you use ES modules with ".js" extension) and it will discover all the tests in any file (indirectly) imported from your entry point, and run them:
(node:2031) ExperimentalWarning: The ESM module loader is experimental.
* subpath::filename::test_a ... ok
impunity looks for an exported function called tests (you can choose another name to look for with the --symbol ... flag).
To remove the tests from a production build, Rollup does a good job of removing unused code automatically during bundling.
impunity uses esbuild-node-loader to transform source files, including typescript files.
FAQs
js test runner that finds unit tests in any imported ES module
The npm package impunity receives a total of 65 weekly downloads. As such, impunity popularity was classified as not popular.
We found that impunity demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.