
Research
/Security News
Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.
@hubspot/serverless-dev-runtime
Advanced tools
A tool for testing HubSpot CMS serverless functions locally
A serverless function development runtime that can be used to test CMS serverless functions. This is intended for use with the HubSpot CLI.
⚠️ This is a BETA release that uses some HubSpot features that are not available to all customer accounts. Please refer to the HubSpot Developer Beta Terms ⚠️
For more information on using these tools, see Local Development Tooling: Getting Started.
Using the CLI to run serverless functions locally, requires installing @hubspot/cli. Once installed, to test your functions run…
hs functions test <folder.functions>
It also is possible to use the runtime inside your own tooling. To start the server, the start method can be imported from the @hubspot/serverless-dev-runtime package and run with settings like so...
const { start } = require('@hubspot/serverless-dev-runtime');
start({
accountId: <portalId/accountId>, // default: 123456
contact: <booleanValueToSpecifyIfContactDataShouldBePassedToServerlessFunction>, // default: true
path: <pathToLocalDotFunctionsFolder>, // required
port: <customPortToRunServerOn> // default: 5432
});
Some of the data that is passed to the serverless function context is mocked. Specifically the contact and limits properties. It is possible
to modify the mocked data by setting values for specific variables within a .env file within the .functions folder.
The variables used to modify the data are:
HUBSPOT_LIMITS_TIME_REMAINING // default: 600000
HUBSPOT_LIMITS_EXECUTIONS_REMAINING // default: 60
HUBSPOT_CONTACT_VID // default: 123
HUBSPOT_CONTACT_IS_LOGGED_IN // default: false
HUBSPOT_CONTACT_LIST_MEMBERSHIPS // default: []
Usage example .env:
HUBSPOT_LIMITS_TIME_REMAINING=1000
HUBSPOT_LIMITS_EXECUTIONS_REMAINING=2
HUBSPOT_CONTACT_VID=456
HUBSPOT_CONTACT_IS_LOGGED_IN=true
HUBSPOT_CONTACT_LIST_MEMBERSHIPS="some, memberships"
FAQs
A tool for testing HubSpot CMS serverless functions locally
The npm package @hubspot/serverless-dev-runtime receives a total of 15,399 weekly downloads. As such, @hubspot/serverless-dev-runtime popularity was classified as popular.
We found that @hubspot/serverless-dev-runtime demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 35 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.