
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
postman-bdd
Advanced tools

Postman-BDD is no longer necessary, because Postman now has its own BDD and fluent syntax built-in!
I recommend that you start using Postman's new test syntax instead of Postman-BDD. However, if you want to continue using Postman-BDD, then you can find the original ReadMe here.
// example using pm.response.to.have
pm.test("response is ok", () => {
pm.response.to.have.status(200);
});
// example using pm.expect()
pm.test("environment to be production", () => {
pm.expect(pm.environment.get("env")).to.equal("production");
});
// example using response assertions
pm.test("response should be okay to process", () => {
pm.response.to.not.be.error;
pm.response.to.have.jsonBody("");
pm.response.to.not.have.jsonBody("error");
});
// example using pm.response.to.be*
pm.test("response must be valid and have a body", () => {
// assert that the status code is 200
pm.response.to.be.ok; // info, success, redirection, clientError, serverError, are other variants
// assert that the response has a valid JSON body
pm.response.to.be.withBody;
pm.response.to.be.json; // this assertion also checks if a body exists, so the above check is not needed
});
Postman's new BDD and fluent syntax are a bit different from Postman-BDD. Here are the changes you need to make to migrate your tests:
describe blocksdescribe() blocks were optional in Postman-BDD, and they don't exist at all in Postman's new syntax. So just remove them.
it blocks with pm.testPostman-BDD used it blocks to define tests, such as:
it('should return the correct customer', () => {
// assertions here
});
Postman now has pm.test blocks, which work the same way. For example:
pm.test('returns the correct customer', () => {
// assertions here
});
Postman-BDD allowed you to define common assertions or setup/teardown logic in hooks, such as before(), after(), beforeEach() and afterEach(). This is no longer necessary because Postman now allows you to define test scripts for folders and collections.
Postman-BDD used the Chai.js and Chai-HTTP assertion libraries, which let you write assertions using an intuitive, fluent, English-like syntax.
it('should return a 200 response', () => {
response.should.have.status(200);
});
it('should set the Location header', () => {
response.should.have.header('Location');
});
it('should return a JSON response', () => {
response.should.be.json;
});
it('should return the correct customer', () => {
response.body.should.have.property('id', 12345);
});
Postman now supports its own fluent assertion syntax, which is somewhat similar.
pm.test('returns a 200 response', () => {
pm.response.to.have.status(200);
});
pm.test('sets the Location header', () => {
pm.response.to.have.header("Location");
});
pm.test('returns a JSON response', () => {
pm.response.to.be.json;
});
pm.test('returns the correct customer', () => {
let jsonData = pm.response.json();
pm.expect(jsonData.id).to.eql(12345);
});
FAQs
BDD test framework for Postman and Newman
We found that postman-bdd demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.