
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
This is a more-or-less faithful clone of David MacIver's [Minithesis](https://github.com/drmaciver/minithesis), a generative testing library. As such, it offers internal shrinking and a test case database.
This is a more-or-less faithful clone of David MacIver's Minithesis, a generative testing library. As such, it offers internal shrinking and a test case database.
This is, charitably, a very small, young project. It has far fewer generators than mature TypeScript
projects like fast-check, which was what I was using
until I bumped into the problem with fast-check's shrinking: namely, that it can't shrink
effectively through monadic bindings. This
issue illustrates the core
of the problem: once you've used chain (or bind, in Minithesis's terminology), you are pretty
much on your own. Because MiniTSis inherits an internal shrinking
methodology from
Minithesis, you can actually guarantee optimal shrinking (at least given enough time, in small cases):
test('test README example', async () => {
// Usually you'd set this up once and reuse it, dbLocation would be a constant path string.
const db = new DBWrapper(new NodeDataStore<string>(dbLocation));
const testFn = (testCase: TestCase) => {
count += 1;
const choice = testCase.choice(BigInt(10000));
if (choice >= BigInt(8)) {
throw new Error('Choice is too high');
}
};
await expect(
runTest(100, 1234, db, false)(wrapWithName(testFn))
).rejects.toThrow('Choice is too high');
});
In practice, better shrinking really does make it much easier to find minimal test cases, which makes development faster and more fun.
The other thing that it implements is a persistent test case database, which means that if you've found a test case breakage once, it will be tried immediately next time you run the test, which can be helpful if you had to do a lot of work to get the breakage. (MiniTSis itself is reasonably quick, even despite heavy use of bigints rather than numbers, but for my use case, individual property checks can easily take seconds.)
No, there aren't. Unlike Minithesis, though, I'd quite like for this to work for people using TS and JS in production. PRs for more generators gratefully received!
I pull an evil trick to pull some test name information from the Jest runner, and hang it as a property on the side of the passed-in test function. In Minithesis it's done with decorators, but we don't have that in TypeScript, and we actually do need a real, unique name so that the test database can store results.
This does mean that if you change your test names, your failing tests may take a little longer to run until they find the breaks again.
I made a halfhearted effort at making it run on the client side by abstracting out the test database
so that it can be run using localStorage, but the test harness still uses the fs/promises module
so I don't expect the test suite to actually run clientside. This is fixable with time and effort.
More generators, as mentioned.
fast-check compatibility shim, if possible.
set up CI on github.
FAQs
This is a more-or-less faithful clone of David MacIver's [Minithesis](https://github.com/drmaciver/minithesis), a generative testing library. As such, it offers internal shrinking and a test case database.
The npm package minitsis receives a total of 96 weekly downloads. As such, minitsis popularity was classified as not popular.
We found that minitsis demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.