
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
@hubspot/serverless-dev-runtime
Advanced tools
A serverless function development runtime that can be used to test CMS serverless functions. This is intended for use with the CMS CLI.
⚠️ This is a BETA release that uses some HubSpot features that are not available to all customer accounts. Please refer to the HubSpot Developer Beta Terms ⚠️
For more information on using these tools, see Local Development Tooling: Getting Started.
Using the CLI to run serverless functions locally, requires installing @hubspot/cli. Once installed, to test your functions run…
hs functions test <folder.functions>
It also is possible to use the runtime inside your own tooling. To start the server, the start method can be imported from the @hubspot/serverless-dev-runtime package and run with settings like so...
const { start } = require('@hubspot/serverless-dev-runtime');
start({
accountId: <portalId/accountId>, // default: 123456
contact: <booleanValueToSpecifyIfContactDataShouldBePassedToServerlessFunction>, // default: true
path: <pathToLocalDotFunctionsFolder>, // required
port: <customPortToRunServerOn> // default: 5432
});
Some of the data that is passed to the serverless function context is mocked. Specifically the contact and limits properties. It is possible
to modify the mocked data by setting values for specific variables within a .env file within the .functions folder.
The variables used to modify the data are:
HUBSPOT_LIMITS_TIME_REMAINING // default: 600000
HUBSPOT_LIMITS_EXECUTIONS_REMAINING // default: 60
HUBSPOT_CONTACT_VID // default: 123
HUBSPOT_CONTACT_IS_LOGGED_IN // default: false
HUBSPOT_CONTACT_LIST_MEMBERSHIPS // default: []
Usage example .env:
HUBSPOT_LIMITS_TIME_REMAINING=1000
HUBSPOT_LIMITS_EXECUTIONS_REMAINING=2
HUBSPOT_CONTACT_VID=456
HUBSPOT_CONTACT_IS_LOGGED_IN=true
HUBSPOT_CONTACT_LIST_MEMBERSHIPS="some, memberships"
FAQs
A tool for testing HubSpot CMS serverless functions locally
The npm package @hubspot/serverless-dev-runtime receives a total of 6,924 weekly downloads. As such, @hubspot/serverless-dev-runtime popularity was classified as popular.
We found that @hubspot/serverless-dev-runtime demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 35 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.