
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
mock-master
Advanced tools
像拼接积木那样管理mock数据的本地mock数据工具。
npm install --save-dev mock-master
使用方式很灵活,我们先看最简单的用法。
在项目根目录创建文件夹,命名为mockFiles。
然后目录中新建一个文件,命名为kitty.js。
# 目录结构
├── mockFiles
│ └── kitty.js
// kitty.js
module.exports = () => {
return {
message: 'ok',
code: 200,
result: {
name: 'kitty',
age: 10
}
}
}
创建mock数据拼接管理文件,命名为mockSwitchMap.js。
这个文件用途之后会介绍,它是本工具最重要的元素之一。
# 目录结构
├── mockFiles
│ └── kitty.js
├── mockSwitchMap.js
module.exports = {
share: [],
api: []
}
新建mock的node服务启动文件,命名为mockServer.js。
# 目录结构
├── mockFiles
│ └── kitty.js
├── mockServer.js
├── mockSwitchMap.js
// mockServer.js
const MockMaster = require('mock-master')
const path = require('path')
const mockSwitchMap = require('./mockSwitchMap.js')
/**
* config说明
* @param mockRoot mock文件的根目录
* @param port mock服务的端口
* @param mockSwitchMap mock管理列表
* @param apiPrefix 客户端请求api的前缀,比如'/api/kitty.json',apiPrefix就是'/api'
* @param apiSuffix 客户端请求api的后缀,比如'/api/kitty.json',apiSuffix就是'.json'
*/
const mock = new MockMaster({
root: path.join(__dirname, 'mockFiles'),
port: 7878,
switchMap: mockSwitchMap,
apiPrefix: '/api',
apiSuffix: '.htm'
})
// 启动mock服务
mock.start()
运行:
node mockServer.js
这样,就可以像简单的mock工具那样使用了。
如果这工具只能和普通的mock工具那样,就没存在的意义了。所以我们接下来介绍进阶方式。
FAQs
mock server
We found that mock-master demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.