Security News
pnpm 10.0.0 Blocks Lifecycle Scripts by Default
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Professor X: For someone who hates mutants... you certainly keep some strange company.
William Stryker: Oh, they serve their purpose... as long as they can be controlled.
This repository is a work in progress. We only support Jasmine tests in the browser for now. Please create and vote on issues to help us determine the priority on features.
Stryker is a mutation testing framework for JavaScript. It allows you to test your test by temporarily inserting bugs.
To install stryker, execute the command:
npm install stryker --save-dev
Note*: During the installation you may run into errors caused by node-gyp. It is safe to ignore these errors.*
To test if stryker is working, execute the command:
node node_modules/stryker/dist/src/Stryker.js --help
Stryker can be used in two ways:
node node_modules/stryker/src/Stryker.js -c stryker.conf.js
node node_modules/stryker/src/Stryker.js –m src/myFirstFile.js,src/mySecondFile.js –f libs/externalLibrary.js,src/myFirstFile.js,src/mySecondFile.js,test/*.js
The config file is not a simple json file, it should be a common js (a.k.a. npm) module looking like this:
module.exports = function(config){
config.set({
// Your config here
});
}
You might recognize this way of working from the karma test runner.
If both the config file and command line options are combined, the command line arguments will overrule the options in the config file.
All options are optional except the files
(or -f
) and mutate
(or -m
) options.
With files
you configure all files needed to run the tests, except the test framework files themselves (jasmine).
The order in this list is important, because that will be the order in which the files are loaded.
With mutate
you configure the subset of files to target for mutation. These should be your source files.
Both the files
and mutate
options are a list of globbing expressions. The globbing expressions will be resolved
using node glob. This is the same globbing format you might know from
Grunt and Karma.
The way to provide this list is as an array in the config file, or as a comma seperated list on the command line (without spaces or quotes)
Options can be configured either via the command line or via a config file.
Short notation: -m
Full notation: --mutate
Config file key: mutate
Description:
A comma seperated list of globbing expressions used for selecting the files that should be mutated.
Example: -m src/**/*.js,a.js`
Short notation: -f
Full notation: --files
Config file key: files
Description:
A comma seperated list of globbing expressions used for selecting all files needed to run the tests.
These include: test files, library files, source files (the files selected with --mutate
) and any other file you need to run your tests.
The order of the files specified here will be the order used to load the file in the test runner (karma).
Example: -f node_modules/a-lib/\*\*/\*.js,src/\*\*/\*.js,a.js,test/\*\*/\*.js
Short notation: (none)
Full notation: --logLevel
Config file key: logLevel
Description:
Set the log4js loglevel. Possible values: fatal, error, warn, info, debug, trace, all and off. Default is "info"
Note: We are still migrating to using log4js. Some messages are not configurable
Short notation: -c
Full notation: --configFile
Description:
A location to a config file. That file should export a function which accepts a "config" object.
On that object you can configure all options as an alternative for the command line.
If an option is configured on both the command line and in the config file, the command line wins.
An example config:
module.exports = function(config){
config.set({
files: ['../../../sampleProject/src/?(Circle|Add).js', '../../../sampleProject/test/?(AddSpec|CircleSpec).js'],
mutate: ['../../../sampleProject/src/?(Circle|Add).js'],
logLevel: 'debug'
});
}
Original | Mutated |
---|---|
a + b | a - b |
a - b | a + b |
a * b | a / b |
a / b | a * b |
a & b | a * b |
Original | Mutated |
---|---|
a++ | a-- |
a-- | a++ |
++a | --a |
--a | ++a |
+a | -a |
-a | +a |
Original | Mutated |
---|---|
a < b | a <= b |
a <= b | a < b |
a > b | a >= b |
a >= b | a < b |
Original | Mutated |
---|---|
a == b | a != b |
a != b | a == b |
a === b | a !== b |
a !== b | a === b |
a <= b | a > b |
a >= b | a < b |
a < b | a >= b |
a > b | a <= b |
a && b | a || b |
a || b | a && b |
Original | Mutated |
---|---|
for (var i = 0; i < 10; i++) { } | for (var i = 0; false; i++) { } |
while (a > b) { } | while (false) { } |
do { } while (a > b); | do { } while (false); |
if (a > b) { } | if (true) { } |
if (a > b) { } | if (false) { } |
FAQs
The extendable JavaScript mutation testing framework
The npm package stryker receives a total of 387 weekly downloads. As such, stryker popularity was classified as not popular.
We found that stryker demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.
Research
Security News
Socket researchers have discovered multiple malicious npm packages targeting Solana private keys, abusing Gmail to exfiltrate the data and drain Solana wallets.