
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
ember-cli-code-coverage-ts
Advanced tools
Code coverage for ember projects using Istanbul with TS support
Code coverage using Istanbul for Ember apps.
>= 1.6.0 for which you need ember-cli > 2.4.3ember-cli-mirage >= 0.1.13pretender >= 0.11.0ember install ember-cli-code-coverageCoverage will only be generated when an environment variable is true (by default COVERAGE) and running your test command like normal.
For example:
COVERAGE=true ember test
If you want your coverage to work on both Unix and Windows, you can do this:
npm install cross-env --save-dev
and then:
cross-env COVERAGE=true ember test
When running with parallel set to true, the final reports can be merged by using ember coverage-merge. The final merged output will be stored in the coverageFolder.
Configuration is optional. It should be put in a file at config/coverage.js (configPath configuration in package.json is honored)
coverageEnvVar: Defaults to COVERAGE. This is the environment variable that when set will cause coverage metrics to be generated.
reporters: Defaults to ['lcov', 'html']. The json-summary reporter will be added to anything set here, it is required. This can be any reporters supported by Istanbul.
excludes: Defaults to ['*/mirage/**/*']. An array of globs to exclude from instrumentation. Useful to exclude files from coverage statistics.
coverageFolder: Defaults to coverage. A folder relative to the root of your project to store coverage results.
useBabelInstrumenter: Defaults to false. Whether or not to use Babel instrumenter instead of default instrumenter. The Babel instrumenter is useful when you are using features of ESNext as it uses your Babel configuration defined in ember-cli-build.js.
babelPlugins: Defaults to ['babel-plugin-transform-async-to-generator']. When using the Babel instrumenter, this specifies a set of additional plugins to pass to the parser. Use this to parse specific ESNext features you may be using in your app (decorators, for instance).
parallel: Defaults to false. Should be set to true if parallel testing is being used, for example when using ember-exam with the --parallel flag. This will generate the coverage reports in directories suffixed with _<random_string> to avoid overwriting other threads reports. These reports can be joined by using the ember coverage-merge command (potentially as part of the posttest hook in your package.json).
module.exports = {
coverageEnvVar: 'COV'
}
To work, this addon has to post coverage results back to a middleware at /write-coverage.
If you are using ember-cli-mirage you should add the following:
// in mirage/config.js
this.passthrough('/write-coverage');
this.namespace = 'api'; // It's important that the passthrough for coverage is before the namespace, otherwise it will be prefixed.
If you are using ember-cli-pretender you should add the following:
// where ever you set up the Pretender Server
var server = new Pretender(function () {
this.post('/write-coverage', this.passthrough);
});
This addon was inspired by ember-cli-blanket.
The primary differences are that this addon uses Istanbul rather than Blanket for coverage and it instruments your application code as part of the build, when enabled.
FAQs
Code coverage for ember projects using Istanbul with TS support
The npm package ember-cli-code-coverage-ts receives a total of 6 weekly downloads. As such, ember-cli-code-coverage-ts popularity was classified as not popular.
We found that ember-cli-code-coverage-ts demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.