
Security News
AI Agent Lands PRs in Major OSS Projects, Targets Maintainers via Cold Outreach
An AI agent is merging PRs into major OSS projects and cold-emailing maintainers to drum up more work.
If you find this useful, please consider supporting my work with a donation or nominate me for a GitHub Star.
A utility for mocking out fetch() requests and responses.
See the website.
npm install mentoss
There are three primary classes in Mentoss:
MockServer - a server implementation where you can mock out requests and responsesFetchMocker - the utility that creates a new fetch() function that calls one or more MockServersMockAgent - an undici Dispatcher that intercepts undici requests and routes them to MockServersfetch() (browser and Node.js)In general, you'll create a MockServer first and then create a FetchMocker, like this:
import { MockServer, FetchMocker } from "mentoss";
// create a new server with the given base URL
const server = new MockServer("https://api.example.com");
// simple mocked route
server.get("/foo/bar", 200);
// return specific response
server.post("/foo/baz", {
status: 200,
body: { message: "Success" },
headers: {
"Content-Type": "application/json",
},
});
// match more of the request
server.post(
{
url: "/foo/boom",
headers: {
"Content-type": "application/json",
},
body: {
test: true,
},
},
404,
);
// create a mocker that uses the server
const mocker = new FetchMocker({
servers: [server],
});
// here's your shiny new fetch() function if you want to use it directly
const { fetch } = mocker;
// or overwrite the global
mocker.mockGlobal();
// make a request
const response = await fetch("https://api.example.com/foo/bar");
// check that the request was made
assert(mocker.called("https://api.example.com/foo/bar"));
// check that all routes were called
assert(mocker.allRoutesCalled());
// clear the server to start over
server.clear();
// clear everything in the mocker (including servers)
mocker.clearAll();
If you're using undici for HTTP requests, you can use MockAgent as a dispatcher:
import { MockServer, MockAgent } from "mentoss";
import { request } from "undici";
// create a new server with the given base URL
const server = new MockServer("https://api.example.com");
// simple mocked route
server.get("/foo/bar", { status: 200, body: "OK" });
// create an agent that uses the server
const agent = new MockAgent({
servers: [server],
});
// make a request using the agent as a dispatcher
const { statusCode, body } = await request("https://api.example.com/foo/bar", {
dispatcher: agent,
});
// check that the request was made
assert(agent.called("https://api.example.com/foo/bar"));
// check that all routes were called
assert(agent.allRoutesCalled());
// clear the agent
agent.clearAll();
Note: MockAgent does not support baseUrl or credentials options, as these are only relevant for browser contexts.
To work on Mentoss, you'll need:
Make sure both are installed by visiting the links and following the instructions to install.
Now you're ready to clone the repository:
git clone https://github.com/humanwhocodes/mentoss.git
Then, enter the directory and install the dependencies:
cd mentoss
npm install
After that, you can run the tests via:
npm test
Jest doesn't support ESM-only modules (like Mentoss) by default. You'll need to update how you call Jest in your package.json file to enable ESM support:
"scripts": {
- "test": "jest",
+ "test": "node --experimental-vm-modules ./node_modules/.bin/jest"
}
Read more about ESM support in the Jest documentation.
Copyright 2024-2025 Nicholas C. Zakas
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
This project takes inspiration (but not code) from a number of other projects:
fetch.Apache 2.0
One day, I was sitting around thinking, "you know, I really wish there was a better fetch mocker." Then I thought, "fetch mocker" sounds a lot like "fresh maker," like the old Mentos commercial. Then I thought, you can't just name a package "fetch mocker" because it's too generic. I'd like to call it Mentos as a joke, but then I worried about the company coming after me for trademark infringement. So I figured I'd add an "s" at the end, to make "OSS" the suffix.
FAQs
A utility to mock fetch requests and responses.
The npm package mentoss receives a total of 661 weekly downloads. As such, mentoss popularity was classified as not popular.
We found that mentoss demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
An AI agent is merging PRs into major OSS projects and cold-emailing maintainers to drum up more work.

Research
/Security News
Chrome extension CL Suite by @CLMasters neutralizes 2FA for Facebook and Meta Business accounts while exfiltrating Business Manager contact and analytics data.

Security News
After Matplotlib rejected an AI-written PR, the agent fired back with a blog post, igniting debate over AI contributions and maintainer burden.