
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Please support our friend Vadim Demedes and the people in Ukraine.

AVA is a test runner for Node.js with a concise API, detailed error output, embrace of new language features and thread isolation that lets you develop with confidence 🚀
Watch this repository and follow the Discussions for updates.
Read our contributing guide if you're looking to contribute (issues / PRs / etc).

Translations: Español, Français, Italiano, 日本語, 한국어, Português, Русский, 简体中文
To install and set up AVA, run:
npm init ava
Your package.json will then look like this (exact version notwithstanding):
{
"name": "awesome-package",
"type": "module",
"scripts": {
"test": "ava"
},
"devDependencies": {
"ava": "^5.0.0"
}
}
Or if you prefer using Yarn:
yarn add ava --dev
Alternatively you can install ava manually:
npm install --save-dev ava
Make sure to install AVA locally. AVA cannot be run globally.
Don't forget to configure the test script in your package.json as per above.
Create a file named test.js in the project root directory.
Note that AVA's documentation assumes you're using ES modules.
import test from 'ava';
test('foo', t => {
t.pass();
});
test('bar', async t => {
const bar = Promise.resolve('bar');
t.is(await bar, 'bar');
});
npm test
Or with npx:
npx ava
Run with the --watch flag to enable AVA's watch mode:
npx ava --watch
AVA supports the latest release of any major version that is supported by Node.js itself. Read more in our support statement.
AVA adds code excerpts and clean diffs for actual and expected values. If values in the assertion are objects or arrays, only a diff is displayed, to remove the noise and focus on the problem. The diff is syntax-highlighted too! If you are comparing strings, both single and multi line, AVA displays a different kind of output, highlighting the added or missing characters.

AVA automatically removes unrelated lines in stack traces, allowing you to find the source of an error much faster, as seen above.
AVA automatically detects whether your CI environment supports parallel builds. Each build will run a subset of all test files, while still making sure all tests get executed. See the ci-parallel-vars package for a list of supported CI environments.
Please see the files in the docs directory:
We have a growing list of common pitfalls you may experience while using AVA. If you encounter any issues you think are common, comment in this issue.
t.plan()AVA, not Ava or ava. Pronounced /ˈeɪvə/: Ay (face, made) V (vie, have) A (comma, ago)
It's the Andromeda galaxy.
Concurrency is not parallelism. It enables parallelism.
![]() | ![]() |
|---|---|
| Mark Wubben | Sindre Sorhus |
Mocha is a feature-rich JavaScript test framework running on Node.js and in the browser, making asynchronous testing simple and fun. It provides a variety of interfaces (e.g., BDD, TDD) and supports both synchronous and asynchronous testing. Compared to AVA, Mocha is more flexible but requires more configuration to achieve similar functionality.
Jest is a delightful JavaScript Testing Framework with a focus on simplicity. It works out of the box for most JavaScript projects and includes features like snapshot testing, a built-in mocking library, and code coverage. Jest is more opinionated than AVA and provides a more integrated experience, especially for React applications.
Tape is a tap-producing test harness for Node.js and browsers. It is minimalistic and focuses on providing a simple API for writing tests. Tape does not include features like test runners or reporters, which makes it less feature-rich compared to AVA but also simpler and more lightweight.
FAQs
Node.js test runner that lets you develop with confidence.
The npm package ava receives a total of 432,155 weekly downloads. As such, ava popularity was classified as popular.
We found that ava demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.