Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
This is a proof-of-concept Minitest plugin to help avoid writing completely meaningless tests. A meaningless test is one that always passes because of incorrect test setup. This plugin helps ensure tests aren't meaningless, by trying to make them fail.
For example, in a Rails app we might have a test that looks like this:
test "#visible_comments excludes hidden comments" do
post = create(:post)
comment = create(:comment, status: "hidden")
refute_includes post.visible_comments, comment
end
The comment
record is completely unrelated to the post
record. It doesn't matter what the status
is, nor does it really matter what the #visible_comments
implementation looks like, there's no reason this comment would ever be returned. It always passes, it's a false positive test.
This plugin adds an important!
annotation to wrap the most important test setup variable. The test runner can then run the test both with and without evaluating that block. If the test passes when that important!
block is not evaluated, then we know it is not meaningful.
test "#visible_comments excludes hidden comments" do
post = create(:post)
comment = create(:comment)
important! { comment.update!(status: "hidden") }
refute_includes post.visible_comments, comment
end
Install the gem and add to the application's Gemfile by executing:
$ bundle add minitest-meaningful
If bundler is not being used to manage dependencies, install the gem by executing:
$ gem install minitest-meaningful
Include the Minitest::Meaningful
module in your test:
class ExampleTest > Minitest::Test
include Minitest::Meaningful
end
Annotate the most important test setup variable:
def test_visible_comments_excludes_hidden_comments
post = create(:post)
comment = create(:comment)
important! { comment.update!(status: "hidden") }
refute_includes post.visible_comments, comment
end
Assert the test should fail:
assert_meaningful :test_visible_comments_excludes_hidden_comments
Run the test with the --meaningful
flag:
$ ruby example_test.rb --meaningful
This is definitely a hacky proof-of-concept. If you can think of a better way to integrate this into Minitest test suites, or a way to more robustly identify false-positive tests, please let me know! Also, I hate the name—please suggest something better!
FAQs
Unknown package
We found that minitest-meaningful demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.