
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@elasticpath/component-test-framework
Advanced tools
With Yarn
yarn add --dev @elasticpath/component-test-framework
With NPM
npm install --save-dev @elasticpath/component-test-framework
The framework exposes a few classes:
This is the class responsible for communicating with your API. You can use the methods directly, however, it's usually a better idea to have it as a binding.
Example
import { binding, then } from 'cucumber-tsflow'
import { Api } from 'component-test-framework'
@binding([ Api ])
export default class MyStepDefinitions {
constructor(protected api: Api) {
}
@then(...)
public async myStep(): void {
await this.api.get('/products')
}
...
Because everything that comes from the Gherkin language is a string, it's impossible to specify literals such as null.
The framework has a Payload class to handle such cases. Whenever you want to send a payload to the API, you can use
const payload = new Payload(table.hashes()[0])
The framework is clever when it comes to type conversions. Consider the following Gherkin table
| null | 123 | foo | "" | [{"foo": "bar"}] |
When sent to the framework, they are all strings
[ "null", "123", "foo", "\"\"", "[{\"foo\": \"bar\"}]"]
The new Payload method does some conversion for us. Here's a mapping of the conversion:
{
"null": null,
"123": "123",
"foo": "foo",
"\"\"": "",
"[{"foo": "bar"}]": [{"foo": "bar"}],
}
You may have noticed the number remains a string. The framework could convert that, however there are certain cases where you need to keep it as a string (a product upc_ean can be specified like a number but is a string). Therefore, the framework introduces a special symbol to force an integer. Given the following gherkin table, the framework will parse the first value as an integer and leave the second as a string
| <i>123 | 456 |
When working with the API in your component tests, it's often benificial to reference the last created resource
Example
Given An admin creates a product
When They get the created product
For this, we can use the ResourceStore. When ever you use the API module, it stores the resource that was created, or fetched in the resource store. Knowing that, we can create our step definition to easily fetch the last created resource
Example
import { ResourceStore } from 'component-test-framework'
...
const resource: Resource = ResourceStore.LastCreated('file')
We can also get all of the resources under one type
Example
import { ResourceStore } from 'component-test-framework'
...
const resource = ResourceStore.FetchByType('file')
And find a resource
Example
import { ResourceStore } from 'component-test-framework'
...
const resource = ResourceStore.Find('file', 'id', 'abc-123')
Each method on the ResourceStore returns a Resource
This is a representation of a resource.
const resource = new Resource(data)
These are usually only created by the ResourceStore. However, there are a few public methods
Useful if you want to build an update payload for your PUT request. If no argument is supplied, then the
resource is returned as a payload, which removes attributes not allowed in payloads (relationships) and nullifies
values which are string "null"
If an argument is supplied, this function will merge the data from that with the current data
Example
const resource = ResourceStore.LastCreated('hierarchy')
const payload = resource.asPayload(table.hashes()[0])
Publishing is handled via the GitLab pipeline. On an MR branch, the pipeline checks to see if the version in package.json is already
a published version, and fails if so, letting you know that the version needs to be updated.
Actual publishing happens on a merge to main.
In the event that a rollback is needed, the rollback MR will fail because the version in package.json will exist on NPM. To resolve this,
you will need to bump the version in package.json.
FAQs
A framework for component tests written using ts-flow
We found that @elasticpath/component-test-framework demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.