
Research
/Security News
PolinRider Spreads Through Compromised GitHub Accounts and Packagist
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.
a small js test runner with Node.js embedded in a single, simple binary

npx pulgar@latest
the main motivation was to find out whether vitest is really the baseline for node.js test runner performance, and I also wanted to learn jai so things coincided into this project.
vitest is fast, but it's not as fast as the computer can go. javascript itself is not as fast as the computer can go, but even with the bottleneck that javascript can be, current test runners are not bottlenecked by the test code.
pulgar # runs every test file under the current directory
pulgar parse # runs files whose path contains "parse"
pulgar ./src/ # runs files whose path starts with src/
arguments are filters on the relative file path. a filter starting with ./ or
/ anchors to the start of the path, anything else matches anywhere. matching
is case-insensitive.
files ending in .test or .spec with .ts, .mts, .cts, .js, .mjs or .cjs are picked up.
there is no config file.
describe, test and it, with skip, todo, fails, skipIf and runIfbeforeAll, afterAll, beforeEach, afterEachexpect with .not, expect.unreachable and expectTypeOftoBe, toEqual, toStrictEqual, toBeNull, toBeUndefined, toBeDefined, toBeTruthy,
toBeFalsy, toThrow, toBeTypeOf, toBeInstanceOf, toBeGreaterThan, toBeGreaterThanOrEqual,
toBeLessThan, toBeLessThanOrEqual, toContain, toContainEqual, toHaveLengthimport { ... } from 'vitest' and import { ... } from '@jest/globals' resolves to pulgar's own api.ts, .js or an index fileimport.meta.url, import.meta.dirname, __filename and __dirnamesee TODO.md.
you need the jai compiler and a node checkout built as a shared library.
git submodule update --init vendor/node
cd vendor/node && ./configure --shared --ninja && ninja -C out/Release && cd ../..
jai build.jai -optimized
node takes a while to build. on windows use vcbuild.bat dll instead of configure and ninja.
FAQs
A test runner with Node.js embedded
The npm package pulgar receives a total of 439 weekly downloads. As such, pulgar popularity was classified as not popular.
We found that pulgar demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

Company News
Allow myself to introduce... myself.