
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
npm install mummy
mummy is a browser extension for the Zombie.js headless browser
testing framework that allows automatic binding of Browser instances to
Hapi servers.
var Browser = require("zombie");
var Mummy = require("mummy");
var browser;
Browser.extend(new Mummy(server));
browser = new Browser();
browser.visit("/")
.then(function () {
. . .
});
Zombie provides an extension API that allows all new
Browser objects to be augmented with additional functionality. Using this
approach, mummy will cause all Browser objects to direct their requests to
the wrapped Hapi server. Only requests with URLs matching the hostname
and port of one of the connections on the server will be injected. All other
requests will be processed normally.
Alternatively, mummy can wrap a single Browser instance as follows:
var Browser = require("zombie");
var Mummy = require("mummy");
var browser = new Browser();
Mummy.embalm(server, browser);
Zombie does not continually evaluate the browser event loop. Rather,
it runs the event loop in relatively short bursts at keep times to drive browser
functionality. In many cases this is fine. However, sometimes it is useful for
test cases to queue events after the initial page load or separate from a user
interaction (i.e. browser.pressButton(...)). In these cases it is useful to
run the event loop for the entire duration of the test. This can be done with
something like the following:
describe("an async interaction", function () {
before(function() {
browser.runner.start();
browser.window.doSomethingInTheFuture();
});
after(function () {
browser.runner.stop();
});
it("eventually does something", ...);
});
mummy also provides the ability to make "raw" HTTP requests to wrapped
servers. This can be useful for testing REST APIs. For example:
var browser = new Browser();
browser.http({ method : "GET", url : "/" }).then(function (response) {
expect(response.statusCode).to.equal(200);
});
Server instance to create a Browser
extension for.Returns a Browser extension suitable for passing to Zombie's
Browser.extend().
Server instance to inject requests into.Browser instance to augment with request redirection.Returns the original Browser instance after it has been augmented to redirect
requests to the server.
Update the browser state to bypass the normal authentication strategies when requests are sent to Hapi. See the Hapi documentation for more details.
Clear any browser credentials. This will cause normal authentication flows to be used for requests sent to Hapi.
Causes Zombie to continually execute the event loop until manually stopped. This is useful for test suites that schedule events after the initial page load. Returns a promise that is resolved when the event loop has stopped.
Stops the event loop when it has been started with browser.runner.start().
(error, response) depending on if the response is successful. If not
provided, a promise is returned.The options hash can include the following:
"GET"."/".Performs a "raw" HTTP request. The server.inject() method from Hapi is used for requests to wrapped servers while Request is used for requests to URLs not belonging to wrapped servers. Additional options are supported for both (see the respective docs for details).
FAQs
Tools for using Zombie.js with Hapi.
The npm package mummy receives a total of 2 weekly downloads. As such, mummy popularity was classified as not popular.
We found that mummy demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.