Re:Self Propagating NPM Malware Compromises over 40 Packages
by user34283 on Wednesday September 17, 2025 @06:49AM
(#45274150)
Jest alone adds 300 packages by the way.
[ Parent
| on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages
by WorldMaker on Wednesday September 17, 2025 @12:29PM
(#45277996)
Yep, which is part of why it feels real good to delete Jest and switch to `node --test`. I realize for a lot of projects that is easier said than done because Jest isn't just the test harness but the assertions framework (`node:assert/strict` isn't terrible; Chai is still a good low-dependency option for fancier styles of assertions) and mocks/substitutes framework (I'm sure there are options there; I never liked Jest's style of mocks so I don't have a recommendation handy).
(ETA: Also, you may not need much for a mocks library because JS' Proxy meta-object isn't that hard to work with directly.)