
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Wirepig helps you test software that relies on something over a network. If your code talks to any of the following, then wirepig can help:
Wirepig spins up an HTTP or TCP server that can programmatically behave like your software's actual dependencies. Simply tell wirepig what kinds of requests to emulate and point your application at it. No monkey-patching the runtime, no external processes, no dependency injection, just honest-to-goodness sockets.
Requires NodeJS >=14.
Install with your favorite package manager:
npm install --save-dev wirepig
yarn add --dev wirepig
Pull in however you get your modules:
import { http, tcp, helpers, errors } from 'wirepig';
const { http, tcp, helpers, errors } = require('wirepig');
And get to mocking:
const dep = await http();
const mock = dep.mock({
req: { method: 'POST', pathname: '/bloop' },
res: { statusCode: 200, body: 'bloop' },
});
const res = await request.post(`http://localhost:${dep.port}/bloop`)
assert.strictEqual(res.statusCode, 200);
assert.strictEqual(res.text, 'bloop');
await dep.teardown();
Here we:
It's highly recommended that you utilize a test runner's lifecycle hooks to properly manage your mocks:
before(async function () {
this.dep = await tcp();
});
afterEach(function () {
this.dep.reset();
});
after(async function () {
await this.dep.teardown();
});
it('sends a GET request to redis', async function() {
this.dep.mock({
req: ['*2', '$3', 'GET', '$8', 'ns:bloop', ''].join('\r\n'),
res: ['$17', 'bloop-the-big-one', ''].join('\r\n'),
});
const client = createClient({ url: `redis://localhost:${this.dep.port}` });
await client.connect();
assert.strictEqual(await client.get('ns:bloop'), 'bloop-the-big-one');
await client.disconnect();
});
Making sense? Head over to the docs for a full accounting of what wirepig can do.
When things get confounding, set the NODE_DEBUG environment variable to one
of the following:
$NODE_DEBUG | Behavior |
|---|---|
wirepig | Logs general diagnostics |
wirepig.match | Logs diagnostics related to request matching |
wirepig* | Logs all diagnostics |
With the expanded output in your console, you ought to be able to figure out what's going on.
Alternatively, a tool like Wireshark can help you monitor all packets flowing between your application and wirepig, and might yield a clue.
Wirepig occupies a space similar to nock except instead of overriding node internals, wirepig operates as an independent server your application sends real requests to. Since you spin up wirepig in the same process as your tests, you still have programmatic control over it.
I'm optimistic this design will offer a few notable upsides:
The wirepig API strives to offer every desirable feature in a simple package, often at the expense of terseness. For example, there's no built-in magic for handling JSON, even though it's an exceptionally common serialization format (there are some handy helpers, though). First and foremost, wirepig wants to be a strong foundation other projects can build on top of (for example, a redis-specific mocking library).
Of course, wirepig isn't the best tool for every job, and even though it can technically mock a postgres database, that might not be the best idea depending on your needs. Other tools I highly recommend:
Wirepig is open source, but only cautiously open to code contributions. Please do not open a pull request as a way to introduce a change (if you do, I will likely close it and ask you to please file an issue).
That said, I'm eager for any feature requests, bug reports, or general feedback. Please submit an issue to get in touch and we'll take things from there.
FAQs
Better testing through the power of sockets.
The npm package wirepig receives a total of 4,417 weekly downloads. As such, wirepig popularity was classified as popular.
We found that wirepig demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.