
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
assert-throws-async
Advanced tools
Node's builtin `assert.throws` does not work very well with rejecting promises or (equivalently) async functions.
Node's builtin assert.throws does not work very well with rejecting promises or (equivalently) async functions.
This wrapper fixes this.
It also allows you to pass both validation functions and constructors to compare with as I got sick of typing e instanceof MyError in my validation functions.
const assertThrows = require('assert-throws-async');
class MyError extends Error { }
const naughtyFunction = () => {
return Promise.reject(new MyError('waaat'));
}
//...
assertThrows(naughtyFunction, MyError, 'waaat');
assertThrows(f: Function, errorCheck: string | RegExp | ((Error) => boolean));
Runs f().
If it throws or returns a promise that rejects with e:
errorCheck is a string or RegExp, check e.message against errorCheckerrorCheck is a function, run errorCheck(e).If either of these checks are unsuccesful, re-throw e.
If f does not throw e, throw an AssertionError('Expected to throw.').
assertThrows(f: Function, ErrorType: class<Error>);
Runs f().
If it throws or returns a promise that rejects with e:
e is not an instance of ErrorType, re-throw e.If f does not throw e, throw an AssertionError('Expected to throw.').
assertThrows(f: Function, ErrorType: class<Error>, errorCheck: string | RegExp | ((Error) => boolean) );
Combines both the above checks. The ErrorType check is executed first.
FAQs
Node's builtin `assert.throws` does not work very well with rejecting promises or (equivalently) async functions.
We found that assert-throws-async demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.