
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@ava/typescript
Advanced tools
Adds TypeScript support to AVA.
This is designed to work for projects that precompile TypeScript. It allows AVA to load the compiled JavaScript, while configuring AVA to treat the TypeScript files as test files.
In other words, say you have a test file at src/test.ts. You've configured TypeScript to output to build/. Using @ava/typescript you can run the test using npx ava src/test.ts.
Add this package to your project:
npm install --save-dev @ava/typescript
Then, enable TypeScript support either in package.json or ava.config.*:
package.json:
{
"ava": {
"typescript": {
"rewritePaths": {
"src/": "build/"
},
"compile": false
}
}
}
Both keys and values of the rewritePaths object must end with a /. Paths are relative to your project directory.
You can enable compilation via the compile property. If false, AVA will assume you have already compiled your project. If set to 'tsc', AVA will run the TypeScript compiler before running your tests. This can be inefficient when using AVA in watch mode.
Output files are expected to have the .js extension.
AVA searches your entire project for *.js, *.cjs, *.mjs, *.ts, *.cts and *.mts files (or other extensions you've configured). It will ignore such files found in the rewritePaths targets (e.g. build/). If you use more specific paths, for instance build/main/, you may need to change AVA's files configuration to ignore other directories.
If your package.json has configured "type": "module", or you've configured AVA to treat the js extension as module, then @ava/typescript will import the output file as an ES module. Note that this is based on the output file, not the ts extension.
You can configure AVA to recognize additional file extensions. To add (partial†) JSX support:
package.json:
{
"ava": {
"typescript": {
"extensions": [
"ts",
"tsx"
],
"rewritePaths": {
"src/": "build/"
}
}
}
}
If you use the allowJs TypeScript option you'll have to specify the js, cjs and mjs extensions for them to be rewritten.
See also AVA's extensions option.
† Note that the preserve mode for JSX is not (yet) supported.
FAQs
TypeScript provider for AVA
The npm package @ava/typescript receives a total of 34,396 weekly downloads. As such, @ava/typescript popularity was classified as popular.
We found that @ava/typescript demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.