
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
@chargebee/chargebee-apps
Advanced tools
Chargebee Apps CLI tool that enables you to create, test and package the applications
The official CLI tool for creating, testing, and packaging serverless applications for Chargebee Apps.
CLI Command Name: chargebee-apps
The Chargebee Apps CLI is a comprehensive command-line tool that enables developers to build, test, and package serverless applications for Chargebee Apps platform. It provides a complete local development environment with web UI, secure sandbox execution, and automated packaging capabilities.
npm install -g @chargebee/chargebee-apps
npm install @chargebee/chargebee-apps
npx chargebee-apps --help
# 1. Create a new serverless application
chargebee-apps create my-app
# 2. Run the application locally with web UI
chargebee-apps run my-app
# 3. Open http://localhost:15000 to test your handlers
# 4. Package for deployment
chargebee-apps package my-app
create <directory>Creates a new serverless application from a template.
chargebee-apps create my-app
chargebee-apps create my-app --template serverless-node-starter-app
chargebee-apps create my-app --template serverless-node-starter-app-with-iparams
Options:
--template <name> - Template to use (default: serverless-node-starter-app)
serverless-node-starter-app — basic event handlersserverless-node-starter-app-with-iparams — includes support for installation parametersWhat it creates:
manifest.json - Application configurationhandler/handler.js - Event handler implementationstest_data/ - Sample event data for testingtypes/types.d.ts - TypeScript definitionsjsconfig.json - JavaScript project configurationrun <directory>Starts a local development server for testing your application.
chargebee-apps run my-app
chargebee-apps run my-app --port 3000
Options:
-p, --port <port> - Port to run the server on (default: 15000)Features:
http://localhost:15000iparams.json on startup when presentWeb UI Features:
package <directory>Creates a deployment-ready zip package of your application.
chargebee-apps package my-app
chargebee-apps package my-app --name production-v1.0.0
Options:
--name <name> - Custom package name (without .zip extension)Package Contents:
manifest.json - Application configurationiparams.json - Parameter definitions (when present)handler/ - All JavaScript and JSON files from handler directoryiparams.local.jsonOutput:
dist/ directory in your app{app-name}.zip or custom named packagemanifest.jsonDefines your application configuration and event handlers.
{
"events": {
"customer_created": {
"handler": "customerCreateHandler"
},
"subscription_created": {
"handler": "subscriptionCreatedHandler"
}
},
"dependencies": {
"lodash": "^4.17.21"
}
}
handler/handler.jsContains your event handler implementations. Each handler receives a single payload object with payload.event (event data) and, when iparams are defined, payload.iparams.<section>.<param> (installation parameters).
module.exports = {
customerCreateHandler: function(payload) {
console.log('Customer created:', payload.event.content.customer.email);
console.log('Processing fee (%):', payload.iparams.processing_fee_configuration.fee_percentage);
return {
status: 'success',
message: 'Customer processed successfully'
};
},
subscriptionCreatedHandler: function(payload) {
console.log('Subscription created:', payload.event.content.subscription.id);
console.log('Late payment fee (%):', payload.iparams.late_payment_fee_configuration.fee_percentage);
return {
status: 'success',
message: 'Subscription processed successfully'
};
}
};
test_data/Sample event data files for testing (JSON format).
test_data/
├── customer_created.json
├── subscription_created.json
└── invoice_generated.json
types/types.d.tsTypeScript definitions for better development experience.
interface HandlerPayload {
event: EventRecord;
iparams?: Record<string, Record<string, string | number | boolean | string[]>>;
}
iparams.json and iparams.local.json (optional)For apps that need user-configurable settings beyond the three system env vars. Parameters are grouped into sections:
iparams.json — schema under installation_parameters.sections[] (packaged for deployment)iparams.local.json — local test values keyed by section name (not packaged)Handlers access values as payload.iparams.<section_name>.<param_name>. An empty {} in either file means no iparams are defined.
See the iparams template README for the full schema, validation rules, and examples.
When running the development server, these endpoints are available:
GET /Serves the web UI for interactive testing.
GET /api/manifestReturns application manifest and handler validation status.
Response:
{
"events": [
{
"event_type": "customer_created",
"handler": {
"name": "customerCreateHandler",
"exists": true
},
"has_test_data": true
}
]
}
GET /api/test-data/:eventTypeReturns sample test data for the specified event type.
POST /api/invokeExecutes a handler with provided event data.
Request:
{
"event_type": "customer_created",
"id": "evt_123",
"occurred_at": "2024-01-01T00:00:00Z",
"customer": {
"email": "test@example.com"
}
}
Response:
{
"status": "success"
}
GET /api/iparamsReturns the sectioned parameter definitions from iparams.json.
POST /api/iparamsSaves validated parameter definitions to iparams.json.
Request body: { "iparams": { "installation_parameters": { "sections": [...] } } }
GET /api/iparams/inputsReturns parameter values from iparams.local.json (keyed by section).
POST /api/iparams/inputsValidates and saves parameter values to iparams.local.json.
Request body: { "inputs": { "<section_name>": { "<param_name>": <value> } } }
# Create new project
chargebee-apps create my-serverless-app
cd my-serverless-app
# Examine the generated structure
ls -la
# Start development server
chargebee-apps run . --port 3000
# Open web UI in browser
open http://localhost:3000
# Create deployment package
chargebee-apps package . --name production-v1.0.0
# Verify package contents
unzip -l dist/production-v1.0.0.zip
You can create custom templates by placing them in the templates directory:
templates/
└── my-custom-template/
├── manifest.json
├── handler/
│ └── handler.js
└── README.md
The CLI respects these environment variables:
MKPLC_CB_READ_ONLY_API - Chargebee read-only API key for accessing Chargebee data without modificationsMKPLC_CB_READ_WRITE_API - Chargebee read-write API key for full access to modify Chargebee dataMKPLC_SITE_DOMAIN - Chargebee site domain (e.g., your-site.chargebee.com) that gets passed to the application handlersCB_LOG_LEVEL - Controls logging verbosity (DEBUG, INFO, WARN, ERROR)NODE_ENV - Affects development vs production behavior# Test via curl
curl -X POST http://localhost:15000/api/invoke \
-H "Content-Type: application/json" \
-d '{
"event_type": "customer_created",
"customer": {"email": "test@example.com"}
}'
# Run multiple apps on different ports
chargebee-apps run app1 --port 3001
chargebee-apps run app2 --port 3002
chargebee-apps run app3 --port 3003
Make sure you're running commands from the correct directory or providing the correct path.
Ensure your application has a valid manifest.json file in the root directory.
Make sure you have a handler/handler.js file with your event handler implementations.
Port must be a valid number between 1 and 65535.
Choose a different port using the --port option.
CB_LOG_LEVEL=DEBUG chargebee-apps run my-app
chargebee-apps --help
chargebee-apps create --help
chargebee-apps run --help
chargebee-apps package --help
src/commands/ - CLI command implementations (create, run, package)src/api/ - Express server with web UI and API endpointssrc/registry.ts - Dependency injection registrytests/unit/ - Unit tests for CLI commandstests/integration/ - Integration tests for end-to-end workflowsThe public CLI uses these core packages:
@chargebee/chargebee-apps-shared - Common interfaces and types@chargebee/chargebee-apps-libs - Local development implementations// handler/handler.js
module.exports = {
customerCreateHandler: function(event) {
// Process customer creation
const customer = event.customer;
console.log(`New customer: ${customer.email}`);
// Return response
return {
status: 'success',
message: `Customer ${customer.email} processed`
};
}
};
// handler/handler.js
const _ = require('lodash');
module.exports = {
dataProcessHandler: function(event) {
// Use lodash for data manipulation
const processedData = _.map(event.data, item => ({
id: item.id,
name: _.capitalize(item.name),
timestamp: new Date().toISOString()
}));
return {
status: 'success',
processed_count: processedData.length,
data: processedData
};
}
};
// handler/handler.js
module.exports = {
robustHandler: function(event) {
try {
// Process event
if (!event.required_field) {
throw new Error('Missing required field');
}
// Business logic here
const result = processBusinessLogic(event);
return {
status: 'success',
result: result
};
} catch (error) {
console.error('Handler error:', error.message);
return {
status: 'error',
message: error.message
};
}
}
};
See CHANGELOG.md for detailed version history.
FAQs
Chargebee Apps CLI tool that enables you to create, test and package the applications
The npm package @chargebee/chargebee-apps receives a total of 12 weekly downloads. As such, @chargebee/chargebee-apps popularity was classified as not popular.
We found that @chargebee/chargebee-apps demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.