
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
vitest-webextension-mock
Advanced tools
What should we do with the differences between the specs and the chrome
implementation?
For an example, according to the spec, browser.action.setTitle
should take
setTitle({title: string, windowId: number, tabId: number})
according to the specs (MDN), but the chrome implementation is (docs):
setTitle({title: string, tabId: number}, callback: Function)
What should we do in such cases?
We should for sure look at webextension-polyfill which solves this problem and follow what they do (which is most likely following the spec)
browser.runtime.getURL()
chrome-extension://
or moz-extension://
The mock functions will try to emulate browser behavior as best they can. For an example:
browser.action.getTitle({windowId: 1, tabId: 1})
Will return an error because according to the specs, if both windowId
and tabId
are supplied, getTitle
should return an error.
However, we rely on typescript for parameters null checks:
browser.action.getTitle()
is an invalid call as getTitle
expects 1 parameter. The mocked function will not throw if called without a parameter. We recommend you use typescript with @types/webextension-polyfill
to catch these errors at build time.
FAQs
Mock webextension APIs with vitest functions
We found that vitest-webextension-mock demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.