
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
If you find this useful, please consider supporting my work with a donation or nominate me for a GitHub Star.
A utility for mocking out fetch() requests and responses.
See the website.
npm install mentoss
There are two primary classes in Mentoss:
MockServer - a server implementation where you can mock out requests and responsesFetchMocker - the utility that creates a new fetch() function that calls one or more MockServersIn general, you'll create a MockServer first and then create a FetchMocker, like this:
import { MockServer, FetchMocker } from "mentoss";
// create a new server with the given base URL
const server = new MockServer("https://api.example.com");
// simple mocked route
server.get("/foo/bar", 200);
// return specific response
server.post("/foo/baz", {
status: 200,
body: { message: "Success" },
headers: {
"Content-Type": "application/json",
},
});
// match more of the request
server.post(
{
url: "/foo/boom",
headers: {
"Content-type": "application/json",
},
body: {
test: true,
},
},
404,
);
// create a mocker that uses the server
const mocker = new FetchMocker({
servers: [server],
});
// here's your shiny new fetch() function if you want to use it directly
const { fetch } = mocker;
// or overwrite the global
mocker.mockGlobal();
// make a request
const response = await fetch("https://api.example.com/foo/bar");
// check that the request was made
assert(mocker.called("https://api.example.com/foo/bar"));
// check that all routes were called
assert(mocker.allRoutesCalled());
// clear the server to start over
server.clear();
// clear everything in the mocker (including servers)
mocker.clearAll();
To work on Mentoss, you'll need:
Make sure both are installed by visiting the links and following the instructions to install.
Now you're ready to clone the repository:
git clone https://github.com/humanwhocodes/mentoss.git
Then, enter the directory and install the dependencies:
cd mentoss
npm install
After that, you can run the tests via:
npm test
Jest doesn't support ESM-only modules (like Mentoss) by default. You'll need to update how you call Jest in your package.json file to enable ESM support:
"scripts": {
- "test": "jest",
+ "test": "node --experimental-vm-modules ./node_modules/.bin/jest"
}
Read more about ESM support in the Jest documentation.
Copyright 2024-2025 Nicholas C. Zakas
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
This project takes inspiration (but not code) from a number of other projects:
fetch.Apache 2.0
One day, I was sitting around thinking, "you know, I really wish there was a better fetch mocker." Then I thought, "fetch mocker" sounds a lot like "fresh maker," like the old Mentos commercial. Then I thought, you can't just name a package "fetch mocker" because it's too generic. I'd like to call it Mentos as a joke, but then I worried about the company coming after me for trademark infringement. So I figured I'd add an "s" at the end, to make "OSS" the suffix.
FAQs
A utility to mock fetch requests and responses.
The npm package mentoss receives a total of 532 weekly downloads. As such, mentoss popularity was classified as not popular.
We found that mentoss demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.